Add support for managing user auth types

https://fedorahosted.org/freeipa/ticket/3368
Add tests for user auth type management

https://fedorahosted.org/freeipa/ticket/3368
Remove unused utf8_encode_value functions

The utf8_encode_value/_values functions from ipautil are no longer used.
Remove them.
Server does not detect different server and IPA domain

Server installer does not properly recognize a situation when server
fqdn is not in a subdomain of the IPA domain, but shares the same
suffix.

For example, if server FQDN is ipa-idm.example.com and domain
is idm.example.com, server's FQDN is not in the main domain, but
installer does not recognize that. proper Kerberos realm-domain
mapping is not created in this case and server does not work
(httpd reports gssapi errors).

https://fedorahosted.org/freeipa/ticket/4012
Fix regression which prevents creating a winsync agreement

A regression, which prevented creation of a winsync agreement,
was introduced in the original fix for ticket #3989.

https://fedorahosted.org/freeipa/ticket/3989
Map NT_STATUS_INVALID_PARAMETER to most likely error cause: clock skew

When we get NT_STATUS_INVALID_PARAMETER in response to establish
DCE RPC pipe with Kerberos, the most likely reason is clock skew.
Suggest that it is so in the error message.

https://fedorahosted.org/freeipa/ticket/4024
Use EXTERNAL auth mechanism in ldapmodify

Default to using the EXTERNAL authorization mechanism in calls to ldapmodify

https://fedorahosted.org/freeipa/ticket/3895
Add automember rebuild command

Add a new command to IPA CLI: ipa automember-rebuild

The command integrates the automember rebuild membership task functionality
into IPA CLI. It makes it possible to rebuild automember membership for
groups/hostgroups.

Design: http://www.freeipa.org/page/V3/Automember_rebuild_membership
https://fedorahosted.org/freeipa/ticket/3752
Add a privilege and a permission needed for automember rebuild command

Design: http://www.freeipa.org/page/V3/Automember_rebuild_membership
https://fedorahosted.org/freeipa/ticket/3752
Add unit tests for automember rebuild command

Design: http://www.freeipa.org/page/V3/Automember_rebuild_membership
https://fedorahosted.org/freeipa/ticket/3752
Fix error message when adding duplicate automember rule

Also fix object_name and object_name_plural for automember rules.

https://fedorahosted.org/freeipa/ticket/2708
Add automember rebuild command to the web UI

Design: http://www.freeipa.org/page/V3/Automember_rebuild_membership
https://fedorahosted.org/freeipa/ticket/3928
Web UI integration test driver enhancement

Handle selecting an option from a select box.

https://fedorahosted.org/freeipa/ticket/3928
Add web UI integration tests for automember rebuild

Design: http://www.freeipa.org/page/V3/Automember_rebuild_membership
https://fedorahosted.org/freeipa/ticket/3928
ipa-client-install: Added options to configure firefox

Option --configure-firefox configures firefox to use Kerberos
credentials within IPA domain
Optional option --firefox-dir=DIR allows to user to specify non-standard
path where firefox install directory is placed.

Part of ticket: https://fedorahosted.org/freeipa/ticket/3821
Removed old firefox configuration scripts

Part of ticket https://fedorahosted.org/freeipa/ticket/3821