And my next concern would become a non-issue if the above was supported, but is there a way to set the dnpass equal to a SSHA password? When I try setting it like this: dnpass = {SSHA}VhxqnmwCLVQj7g3rQV+g9F3XnaJ6bRXR

No, you need to supply the actual password. This password is (presumably) already stored hashed in your LDAP database. Your LDAP server will hash what it receives as the password and compare that with the password stored for that DN. Setting it like you have shown just causes Dovecot to use it as the literal password {SSHA}Vhxqnm.....

I'd prefer not to have the password for the authentication admin user stored in plain text in the conf file.

There's no way to store an encrypted password in a conf file and have a plaintext version of that password used to authenticate (without e.g. manually typing a password each time that config file is read).

The DN used with the current Dovecot LDAP code obviously only needs read access to mail users' details, you don't have to give it any kind of write access, and you don't have to give it the ability to read passwords for non-mail-users (i.e. passwords for DNs with write access to the directory). You can also additionally restrict access to userPassword by IP addresses, too. So, if you aren't already doing this, at least there are a few ways you can reduce the exposure with the current code.

Of course, if someone has sufficient access to the machine running Dovecot that they can read the config file, they will already have some degree of access to user's passwords...