Revert "MS-PAC: Special case NFS services"

This reverts commit 5269458f552380759c86018cd1f30b64761be92e.

With the implementation of https://fedorahosted.org/freeipa/ticket/2960
a special hardcoded handling of NFS service tickets is not needed
anymore.
Add NFS specific default for authorization data type

Since the hardcoded default fpr the NFS service was removed the default
authorization data type is now set in the global server configuration.

https://fedorahosted.org/freeipa/ticket/2960
ipa-kdb: Read global defaul ipaKrbAuthzData

The ipaKrbAuthzData LDAP attribute is read from the ipaConfig object
and the read value(s) are stored in the ipadb context.

https://fedorahosted.org/freeipa/ticket/2960
ipa-kdb: Read ipaKrbAuthzData with other principal data

The ipaKrbAuthzData LDAP attribute is read together with the other data
of the requestedprincipal and the read value(s) are stored in the e-data
of the entry for later use.

https://fedorahosted.org/freeipa/ticket/2960
ipa-kdb: add PAC only if requested

Instead of always adding a PAC to the Kerberos ticket the global default
for the authorization data and the authorization data of the service
entry is evaluated and the PAC is added accordingly.

https://fedorahosted.org/freeipa/ticket/2960
Add unit test for get_authz_data_types()

https://fedorahosted.org/freeipa/ticket/2960
Mention PAC issue with NFS in service plugin doc

https://fedorahosted.org/freeipa/ticket/2960
Allow 'nfs:NONE' in global configuration

This patch adds 'nfs:NONE' as an allowed entry for the global
authorization data type in the CLI and WebUI. This is an ad-hoc solution
to make sure that the new default value for the NFS service is not
removed by chance.

This patch should be removed if a more generic solution is implemented
to modify service:TYPE style values of the authorization data type.

https://fedorahosted.org/freeipa/ticket/2960
Do not fail if schema cannot be retrieved from LDAP server.
Allow disabling LDAP schema retrieval in LDAPClient and IPAdmin.
Allow disabling attribute decoding in LDAPClient and IPAdmin.
Disable schema retrieval and attribute decoding when talking to AD GC.
Fix installing server with external CA

Reorganize ipa-server-instal so that DS (and NTP server) installation
only happens in step one.

Change CAInstance to behave correctly in two-step install.

Add an `init_info` method to DSInstance that includes common
attribute/sub_dict initialization from create_instance and create_replica.
Use it in ipa-server-install to get a properly configured DSInstance
for later tasks.

https://fedorahosted.org/freeipa/ticket/3459