Combobox keyboard support

Combobox can be controlled just by using keyboard.

When value list is closed, user can:
  * use UP and DOWN error to open list, it will focus the list and
    select previous/next value
  * when CB is non-editable, user can start typing, first character will open
    list, second will be entered into search input. Note: I wanted to copy the
    first char to the search box as well, but I did not figure out reliable
    method for converting keycode to char for non ASCII keyboard layouts
  * ESCAPE, ENTER, TAB keys are handled to allow keyboard operations in a
    container

When value list is opened:
  * CB tries to keep focus on either search input or a select
  * when focus is lost, the value list is closed. So  user can click anywhere
    on a page to close it - two comboboxes can't be opened on the same time
  * hitting TAB key switches between search and select
  * if CB is not searchable, hitting TAB will close the value list and select
    input textbox
  * hitting ESCAPE on will close the value list
  * hitting ENTER on search input will invoke search operation
  * hitting ENTER on select will close the value list
  * hitting UP/DOWN arrows will select previous/next values

Additional modifications:
  * opening arrow and search button were made non-focusable. It fixes the
    'wrong focus area' bug and simplifies keyboard usage. It doesn't affect
    mouse usage.

https://fedorahosted.org/freeipa/ticket/3324
Fix dirty state update of editable combobox

Editable combobox didn't update it's dirty state correctly. CB had it's own
internal value changed event, which was incorrectly used. It was removed and
widget's value_changed event was used instead.
Fix handling of no_update flag in Web UI

There was an incorrect check for no_update flag. Check was performed as
if the flag was an attribute of object not an item of array. Hence, the
flag never caused any effect.
Web UI: configurable SID blacklists

Added blacklists section, with ipantsidblacklistincoming and
ipantsidblacklistoutgoing multivalued textbox fields, into trust details page.

https://fedorahosted.org/freeipa/ticket/3289
Fix remove while iterating in suppress_netgroup_memberof.

https://fedorahosted.org/freeipa/ticket/3464
ipaserver/dcerpc: enforce search_s without schema checks for GC searching
Remove disabled entries from sudoers compat tree.

The removal is triggered by generating an invalid RDN when ipaEnabledFlag of
the original entry is FALSE.

https://fedorahosted.org/freeipa/ticket/3437
Fix internal error in output_for_cli method of sudorule_{enable,disable}.

Also fix incorrect super method call in output_for_cli method of
sudorule_{add,remove}_option.

https://fedorahosted.org/freeipa/ticket/3489
ipa-replica-manage: migrate to single_value after LDAPEntry updates
Don't base64-encode the CA cert when uploading it during an upgrade.

We want to store the raw value. Tools like ldapsearch will automatically
base64 encode the value because it's binary so we don't want to duplicate
that.

https://fedorahosted.org/freeipa/ticket/3477
Revert "MS-PAC: Special case NFS services"

This reverts commit 5269458f552380759c86018cd1f30b64761be92e.

With the implementation of https://fedorahosted.org/freeipa/ticket/2960
a special hardcoded handling of NFS service tickets is not needed
anymore.
Add NFS specific default for authorization data type

Since the hardcoded default fpr the NFS service was removed the default
authorization data type is now set in the global server configuration.

https://fedorahosted.org/freeipa/ticket/2960
ipa-kdb: Read global defaul ipaKrbAuthzData

The ipaKrbAuthzData LDAP attribute is read from the ipaConfig object
and the read value(s) are stored in the ipadb context.

https://fedorahosted.org/freeipa/ticket/2960
ipa-kdb: Read ipaKrbAuthzData with other principal data

The ipaKrbAuthzData LDAP attribute is read together with the other data
of the requestedprincipal and the read value(s) are stored in the e-data
of the entry for later use.

https://fedorahosted.org/freeipa/ticket/2960
ipa-kdb: add PAC only if requested

Instead of always adding a PAC to the Kerberos ticket the global default
for the authorization data and the authorization data of the service
entry is evaluated and the PAC is added accordingly.

https://fedorahosted.org/freeipa/ticket/2960
Add unit test for get_authz_data_types()

https://fedorahosted.org/freeipa/ticket/2960
Mention PAC issue with NFS in service plugin doc

https://fedorahosted.org/freeipa/ticket/2960
Allow 'nfs:NONE' in global configuration

This patch adds 'nfs:NONE' as an allowed entry for the global
authorization data type in the CLI and WebUI. This is an ad-hoc solution
to make sure that the new default value for the NFS service is not
removed by chance.

This patch should be removed if a more generic solution is implemented
to modify service:TYPE style values of the authorization data type.

https://fedorahosted.org/freeipa/ticket/2960
Do not fail if schema cannot be retrieved from LDAP server.
Allow disabling LDAP schema retrieval in LDAPClient and IPAdmin.