Make options checks in idrange-add/mod consistent

Both now enforce the following checks:
  - dom_sid and secondary_rid_base cannot be used together
  - rid_base must be used together if dom_rid is set
  - secondary_rid_base and rid_base must be used together
    if dom_rid is not set

Unit test for third check has been added.

http://fedorahosted.org/freeipa/ticket/3170
Add trusted domain range objectclass when using idrange-mod

When modifing the idrange, one was able to add ipa NT trusted
AD domain sid without objectclass ipatrustedaddomainrange being
added. This patch fixes the issue.