Title: #1036: certmap: sanitize LDAP search filter
patch looks good to me.
Besides few cosmetic comments (see inline) I would only propose to extend `test_certmap.c`
with a case where "()" are really used in a certificate (but perhaps this is not
needed because `util-tests.c::test_sss_filter_sanitize` covers this...)
Covscan is clean.
But unfortunately I don't have environment at hand to actually test this patch.
Perhaps @spoore1 will be able to test this (scratch build provided).
See the full comment at https://github.com/SSSD/sssd/pull/1036#issuecomment-662610790