Free NSS objects in --external-ca scenario

In external CA installation, ipa-server-install leaked NSS objects
which caused an installation crash later when a subsequent call of
NSSConnection tried to free them.

Properly freeing the NSS objects avoid this crash.

https://fedorahosted.org/freeipa/ticket/3773
Web UI integration tests: Add trust tests

https://fedorahosted.org/freeipa/ticket/3744
Web UI integration tests: Add ui_driver method descriptions

https://fedorahosted.org/freeipa/ticket/3744
Web UI integration tests: Verify data after add and mod

https://fedorahosted.org/freeipa/ticket/3744
Web UI integration tests: Compute range sizes to avoid overlaps

Heavily inspired by code from xmlrpc tests.

To obtain ranges, this patch also adds method to execute FreeIPA command through Web UI.
It uses Web UI instead of ipalib so it doesn't need to care about authentication on a test-runner machine.

https://fedorahosted.org/freeipa/ticket/3744
Web UI integration tests: PEP8 fixes

Tests modified to comply with PEP8 rules with exception of rule E501 (long lines).
Done by autopep8 tool and 2 manual modifications.

https://fedorahosted.org/freeipa/ticket/3744
Web UI integration tests: Code quality fixes

 * variables with python build-in names renamed
 * unused parameters used or removed

 https://fedorahosted.org/freeipa/ticket/3744
Skip referrals when converting LDAP result to LDAPEntry

When converting the result obtained by python-ldap library,
we need to skip unresolved referral entries, since they cannot
be converted.

https://fedorahosted.org/freeipa/ticket/3814
Use valid LDAP search base in migration plugin

One find_entry_by_attr call did not set a search base leading to
LDAP search call with zero search base. This leads to false negative
results from LDAP.
Refactor the interactive prompt logic in idrange_add

Make the interactive prompts interpret the following logic:

- AD range (dom-sid/dom-name set):
      require RID base if not set

- local range(dom-sid/dom-name not set):
    a) server with adtrust support:
           require both RID base and secondary RID base
    b) server without adtrust support:
           if any of RID base, secondary RID base set,
           require both of them

https://fedorahosted.org/freeipa/ticket/3786
Honor 'enabled' option for widgets.

https://fedorahosted.org/freeipa/ticket/3793