Add ACI support to control whether a  "smart referral" (named subordinate references -- RFC 3296)
may be returned to a client. Smart referral entries contain the referral objectclass and
have one or more "ref" attributes containing LDAP URLS. The ref attribute type has usage
distributedOperation, so the operational shorthand '+' character can be used to match it:

(targetattr="+")(version 3.0; acl "ref wild-card"; allow(read) userdn="ldap:///anyone";)

or it can be explicitly used:

(targetattr="ref")(version 3.0; acl "ref"; allow(read) userdn="ldap:///anyone";)

It is also possible to add an ACI on the referral entry itself:

dn: uid=smart, ou=People, dc=example, dc=com
objectclass: top
objectClass: extensibleobject
objectClass: referral
ref: ldap://kansashost/OU=People,O=Kansas,C=US
ref: ldap://texashost/OU=People,O=Texas,C=US
aci: (targetattr = "ref")(version 3.0; acl "add_aci"; allow (read) userdn="ldap://anyone";)