Track DS certificate with certmonger on replicas.

https://fedorahosted.org/freeipa/ticket/3975
Add nsswitch.conf to FILES section of ipa-client-install man page

This file is always updated when client is installed or uninstalled.

https://fedorahosted.org/freeipa/ticket/3995
Update Permission and ACI plugins to decorator registration API
Fix indentation in permission plugin tests
Fix invalid assumption NSS initialization check in SSLTransport

There code assumes that the `conn` in any Connection in the context is
a ServerProxy. This might not always be the case: ldap2 uses a
python-ldap connection here.
Help plugin: don't fail if a topic's module is not found

Previously the help plugin failed when searching for the docstring
when a topic's module was not found. This can happen when some server
plugins are loaded (e.g. for tests).

Use empty documentation when the topic is not found.
Use new ipaldap entry API in aci and permission plugin
Improve permission plugin test cleanup

The rename tests use names that were not being cleaned up when the
tests fail. Add cleanup steps for them.

Also, use --force so system permissions are removed as well.
Tests: mkdir_recursive: Don't fail when top-level directory doesn't exist

When the directory directly under root (e.g. /etc) did not exist,
mkdir_recursive failed.
Fix the issue.
beakerlib plugin: Don't try to submit logs if they are missing
Fix password expiration notification

- was broken by navigation and application controller refactoring

https://fedorahosted.org/freeipa/ticket/4003
Remove ipa-pwd-extop and ipa-enrollment duplicate error strings

Some error strings were duplicate which makes it then harder to
see what is the real root cause of it.

https://fedorahosted.org/freeipa/ticket/3988
advice: Add legacy client configuration script using nss-ldap

Part of: https://fedorahosted.org/freeipa/ticket/3833
ipatests: Extend clear_sssd_cache to support non-systemd platforms

Part of: https://fedorahosted.org/freeipa/ticket/3833
ipatests: Restore SELinux context after restoring files from backup

Part of: https://fedorahosted.org/freeipa/ticket/3833
ipatests: Do not use /usr/bin hardcoded paths

Part of: https://fedorahosted.org/freeipa/ticket/3833
ipatests: Add support for extra roles referenced by a keyword

Adds support for host definition by a environment variables of the
following form:

ROLE_<keyword>_envX, where X is the number of the environment
for which host referenced by a role <keyword> should be defined.

Adds a required_extra_roles attribute to the IntegrationTest class,
which can test developer use to specify the extra roles that this
particular test requires. If not all required extra roles are
available, the test will be skipped.

All extra (and static) roles are accessible to the IntegrationTests
via the host_by_role method, which returns a host of given role.

Part of: https://fedorahosted.org/freeipa/ticket/3833
Make LDAPEntry a wrapper around dict rather than a dict subclass.

https://fedorahosted.org/freeipa/ticket/3521
Introduce IPASimpleLDAPObject.decode method for decoding LDAP values.

This method is intended as a counterpart of IPASimpleLDAPObject.encode and
replaces IPASimpleLDAPObject.convert_value_list.

https://fedorahosted.org/freeipa/ticket/3521
Always use lists for values in LDAPEntry internally.

Outside of LDAPEntry, it is still possible to use non-lists. Once we enforce
lists for attribute values, this will be removed.

https://fedorahosted.org/freeipa/ticket/3521