Use a default LDAP search filter of (objectClass=sudoRole). When

Use a default LDAP search filter of (objectClass=sudoRole).  When
constructing the netgroup query, add (sudoUser=*) to the query so
we don't fall below the 3 character OpenLDAP substring threshold.
Otherwise the index for sudoUser will never be used for that query.
Pointed out by Michael Stroeder.