Exclude o=ipaca subtree from Retro Changelog (syncrepl)

CA and DS have issues with Retro Changelog plugin. CA subtree should be
excluded from syncrepl.
This should improve speed of CA related operations too.

https://fedorahosted.org/freeipa/ticket/5538

Reviewed-By: Christian Heimes <cheimes@redhat.com>

install/updates/20-syncrepl.update

@@ -4,6 +4,7 @@ only:nsslapd-pluginEnabled: on
 # Remember original nsuniqueid for objects referenced from cn=changelog
 add:nsslapd-attribute: nsuniqueid:targetUniqueId
 add:nsslapd-changelogmaxage: 2d
+add:nsslapd-exclude-suffix: o=ipaca
 
 # Keep memberOf and referential integrity plugins away from cn=changelog.
 # It is necessary for performance reasons because we don't have appropriate