Fix the identification of LDAP attributes.

[steven-legg]

Appendix B.4 of the core specification has this to say about identifying LDAP attributes:
"Where a suitable attribute is already defined in LDAP, the XACML identifier SHALL be formed by adding the attribute name to the URI of the LDAP specification. For example, the attribute name for the userPassword defined in the RFC 2256 SHALL be:
http://www.ietf.org/rfc/rfc2256.txt#userPassword".

This is just broken. It does not produce unique identifiers and is far from complete. Definitions for many LDAP attributes can be found in more than one RFC and most LDAP attributes in use aren't defined in any RFC at all.

All attributes in LDAP are uniquely identified by an OID, e.g., userPassword is 2.5.4.35 . This should form the basis for identifying LDAP attributes in XACML. There is a URN format for OIDs, e.g., urn:oid:2.5.4.35, which should be used instead.