ipatests: Add Active Directory support to configuration

Part of: https://fedorahosted.org/freeipa/ticket/3834
ipatests: Extend domain object with 'ad' role support and WinHosts

Part of: https://fedorahosted.org/freeipa/ticket/3834
ipatests: Extend IntegrationTest with multiple AD domain support

Part of: https://fedorahosted.org/freeipa/ticket/3834
ipatests: Create util module for ipatests

Part of: https://fedorahosted.org/freeipa/ticket/3834
ipatests: Add WinHost class

Part of: https://fedorahosted.org/freeipa/ticket/3834
ipatests: Add AD-integration related tasks

Part of: https://fedorahosted.org/freeipa/ticket/3834
ipatests: Add AD integration test case

Part of: https://fedorahosted.org/freeipa/ticket/3834
trusts: Fix typo in error message for realm-domain mismatch
Do not roll back failed client installation on server

In case of a failed enrollment, IPA client rolls back any changes it has made
to the system. In order to have a more debuggable setup, do not roll back these
changes in the case of an IPA server install.

https://fedorahosted.org/freeipa/ticket/3990
Make sure nsds5ReplicaStripAttrs is set on agreements

Add nsds5ReplicaStripAttrs to the agreement LDAP entry before the agreement
is created.

https://fedorahosted.org/freeipa/ticket/3989
Do not add kadmin/changepw ACIs on new installs

These ACI were needed when FreeIPA had a custom ipa_kpasswd daemon,
now that a standard kadmin is used, ACIs are not needed anymore as
kadmin uses the same driver as the KDC.

The ACIs is not removed on upgrades to avoid breaking older
replicas which may still use FreeIPA version with the ipa_kpasswd
daemon.

https://fedorahosted.org/freeipa/ticket/3987
Make set_directive and get_directive more strict

When set_directive was used for directive "foo" and the word "foo"
was detected anywhere on the line (e.g. in a comment, or in an example),
it was overwritten which may potentially lead to wrong line being
overwritten.

Only match the directives on the beginning of the lines, it is safer.

https://fedorahosted.org/freeipa/ticket/3974
Remove mod_ssl conflict

Since mod_nss-1.0.8-24, mod_nss and mod_ssl can co-exist on one
machine (of course, when listening to different ports).

To make sure that mod_ssl is not configured to listen on 443
(default mod_ssl configuration), add a check to the installer checking
of either mod_nss or mod_ssl was configured to listen on that port.

https://fedorahosted.org/freeipa/ticket/3974
Fix date in last changelog entry
Add test for external CA installation

https://fedorahosted.org/freeipa/ticket/3819