ipatests: Extend the order plugin to properly handle inheritance

When trying to create a new ordered test case by inheriting
from already defined test case, by overriding few of its methods,
the execution order of the tests is as follows:
    - first all non-overriden test methods from the parent test class
    - then all overriden tests methods

This patch makes sure that methods are executed in the logical order,
that is, the order defined in the parent class.
Installer should always wait until CA starts up

Patch for ticket 3964 changed the installer so that it does not
always wait for CA if the proxy is not configured. However,
it was found out that it may freeze an installation when
a step subsequent after CA restart call the CA and receives no
reply.

Change the wait so that it always waits for CA to start up. If
HTTP proxy is already configured, it should wait on port 443.
If not, it should wait on local PKI port 8443.

https://fedorahosted.org/freeipa/ticket/3973
Administrative password change does not respect password policy

When Directory Manager or a PassSync agent is changing a password,
it is not being expired, but standard expiration time should apply.
However, default expiration time was always applied (90 days)
even though administrator may have a custom policy for the user.

https://fedorahosted.org/freeipa/ticket/3968
test_caless.TestCertInstall: Fix 'test_no_ds_password' test case

The test installed the HTTP cert instead of the DS one.
Use new CLI options in certinstall tests

The --pin and --dirman-password options simplified ipa-certinstall
usage. Use them in tests.

Also add tests for the old way of calling the command.

https://fedorahosted.org/freeipa/ticket/3869
http://www.freeipa.org/page/V3/ipa-server-certinstall_CLI_cleanup
Add ipa-advise plugins for nss-pam-ldapd legacy clients

Add three new ipa-advise plugins, to facilitate configuration of
legacy clients using nss-pam-ldapd:

* config-redhat-nss-pam-ldapd
* config-generic-linux-nss-pam-ldapd
* config-freebsd-nss-pam-ldapd

https://fedorahosted.org/freeipa/ticket/3672
Use a user result template in tests

This makes the tests shorter, more descriptive, and easier to change
e.g. when new attributes are added.
test_simple_replication: Fix waiting for replication

The integration tests must wait for replication to happen before checking
results. In some cases, the tests have failed because the checks that
detect completed replication were insufficient.

This fixes the code to:
- Wait for replication to be completed on both servers
- In the case of an error, continue waiting -- it might be the case that
  the DS is temporarily unreachable
Get the created range type in case of re-establishing trust

This is a regression fix introduced by commit id:
285ed59889590ddd0d6ca2e2a030b28527941cbf

Fixes internal error in case of re-establishing the trust.
trusts: combine filters with AND to make sure only the intended domain matches