Rewrite the ldap escape function, and always escape network-controlled input.

Rewrite the ldap escape function, and always escape network-controlled input.

This new version now will correctly handle 8-bit characters (which need to
be encoded in UTF-8 and then escaped), as well as the corner cases of
leading space or # and trailing space.

This is CVE-2026-33609, part of PowerDNS Security Advisory 2026-05.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>