s4-cldap: don't set the writable bit when we are a RODC