ipa-server-install: Make temporary pin files available for the whole installation

We pass names of files with pkcs12 pins to installers which may continue to
use the files after the initial call to create_instance, at which point
the installer has already removed them.
Also, some of the files were not properly removed on failure.

Use ipautil.write_tmp_file for the pin files, which returns a
NamedTemporaryFile object that removes the underlying file when it is
garbage-collected.
Create the files at start of installation. This will allow checking
the pkcs#12 files before the system is modified.
ipa-server-install: Remove the --selfsign option

Instead, certificates in pkcs12 files can be given to set up
IPA with no CA at all.
Use a flag, setup_ca, to signal if a CA is being installed.

Design: http://freeipa.org/page/V3/Drop_selfsign
Part of the work for: https://fedorahosted.org/freeipa/ticket/3494
Remove unused ipapython.certdb.CertDB class
ipaserver.install.certs: Introduce NSSDatabase as a more generic certutil wrapper

The CertDB class was meant to be a wrapper around NSS databases,
certutil, pk12util, etc. Unfortunately, over time it grew too
dependent on the particular scenarios it is used in.
Introduce a new class that has no knowledge about IPA configuration,
and move generic code to it.

In the future, generic code should be moved to NSSDatabase, code
for the self-signed CA should be removed, and IPA-specific code may
stay in CertDB (which calls NSSDatabase).
Trust CAs from PKCS#12 files even if they don't have Friendly Names

Instead of trusting all certificates with friendly names,
now all certs without a "u" flag are trusted as root certs.
dsinstance, httpinstance: Don't hardcode 'Server-Cert'
Support installing with custom SSL certs, without a CA

Design: http://freeipa.org/page/V3/CA-less_install
https://fedorahosted.org/freeipa/ticket/3363
Load the CA cert into server NSS databases

The CA cert was not loaded, so if it was missing from the PKCS#12 file,
installation would fail.
Pass the cert filename to the server installers and include it in
the NSS DB.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3363
Do not call cert-* commands in host plugin if a RA is not available

Part of the work for: https://fedorahosted.org/freeipa/ticket/3363
ipa-client-install: Do not request host certificate if server is CA-less

https://fedorahosted.org/freeipa/ticket/3536
Web UI: Disable cert functionality if a CA is not available

Part of the work for: https://fedorahosted.org/freeipa/ticket/3363
ipa-pwd-extop: do not use dn until it is really set

https://fedorahosted.org/freeipa/ticket/3539
Properly handle ipa-replica-install when its zone is not managed by IPA

The ipa-replica-install script tries to add replica's A and PTR
records to the master DNS, if master does manage DNS. However,
master need not manage replica's zone. Properly handle this use
case.

https://fedorahosted.org/freeipa/ticket/3496
Require 389-base-base 1.3.0.5

Pulls the following fixes:
- upgrade deadlock caused by DNA plugin reconfiguration
- CVE-2013-1897: unintended information exposure when rootdse is
  enabled

https://fedorahosted.org/freeipa/ticket/3540
Change CNAME and DNAME attributes to single valued

These DNS attributeTypes are of a singleton type, update LDAP schema
to reflect it.

https://fedorahosted.org/freeipa/ticket/3440
https://fedorahosted.org/freeipa/ticket/3450
Improve CNAME record validation

Refactor DNS RR conflict validator so that it is better extensible in
the future. Also check that there is only one CNAME defined for
a DNS record.

PTR+CNAME record combination is no longer allowed as we found out it
does not make sense to have this combination.

https://fedorahosted.org/freeipa/ticket/3450
Improve DNAME record validation

Extend DNS RR conflict check and forbid DNAME+NS combination unless
it is done in root DNS zone record.

Add tests to verify this enforced check.

https://fedorahosted.org/freeipa/ticket/3449