Convert uniqueMember members into DN objects.

We were asserting that they should be DN objects but weren't converting
them anywhere.

https://fedorahosted.org/freeipa/ticket/3339
permission-find no longer crashes with --targetgroup

Target Group parameter was not processed correctly which caused
permission-find to always crash when this search parameter was used.
Fix the crash and create a unit test case to avoid future regression.

https://fedorahosted.org/freeipa/ticket/3335
Avoid CRL migration error message

When CRL files are being migrated to a new directory, the upgrade
log may contain an error message raised during MasterCRL.bin symlink
migration. This is actually being caused by `chown' operation which
tried to chown a symlinked file that was not migrated yet.

Sort migrated files before the migration process and put symlinks
at the end of the list. Also do not run chown on the symlinks as
it is a redundant operation since the symlinked file will be
chown'ed on its own.

https://fedorahosted.org/freeipa/ticket/3336
Sort LDAP updates properly

LDAP updates were sorted by number of RDNs in DN. This, however,
sometimes caused updates to be executed before cn=schema updates.
If the update required an objectClass or attributeType added during
the cn=schema update, the update operation failed.

Fix the sorting so that the cn=schema updates are always run first
and then the other updates sorted by RDN count.

https://fedorahosted.org/freeipa/ticket/3342