PSP-NG should allow the null DN for attributes with DN syntax

The PSP-NG explicitly does not allow attributes on LDAP records for groups to be empty. It should allow attributes that require DN syntax to be empty in order to support use of the null DN (also known as the zero-length DN).

By doing so the PSP-NG would be able to provision an "empty" group with objectClass groupOfNames and the attribute 'member' with no value (the null DN) in the same way as the PSP does.