ldapupdate: Factor out connection code

The connection code will be the same for both the LDAP updater
and the new schema updater.

Preparation for: https://fedorahosted.org/freeipa/ticket/3454
dsinstance: Move the list of schema filenames to a constant

Preparation for: https://fedorahosted.org/freeipa/ticket/3454
Add schema updater based on IPA schema files

The new updater is run as part of `ipa-ldap-updater --upgrade`
and `ipa-ldap-updater --schema` (--schema is a new option).
The --schema-file option to ipa-ldap-updater may be used (multiple
times) to select a non-default set of schema files to update against.

The updater adds an X-ORIGIN tag with the current IPA version to
all elements it adds or modifies.

https://fedorahosted.org/freeipa/ticket/3454
Update the man page for ipa-ldap-updater
Remove schema modifications from update files

As schema is now handled by the schema updater, these entries
are superfluous.

https://fedorahosted.org/freeipa/ticket/3454
Remove schema special-casing from the LDAP updater

Now that there's a dedicated schema updater, we do not need the code
in ldapupdate.

https://fedorahosted.org/freeipa/ticket/3454
Make schema files conform to new updater

The new schema updater only compares textual representations of schema
elements, as formatted by python-ldap.
This works well, but it is too strict for the current schema files in two ways:
- For attribute names in MAY and MUST, the correct letter case must be used
- AttributeTypes must specify explicit EQUALITY and SYNTAX fields even if
    they are the same as its supertype's.
When these restrictions are not followed, the updater will always overwrite
the schema element. This is harmless but it fills up the log unnecessarily.

Modify the schema files to conform to these restrictions.

Part of the work for https://fedorahosted.org/freeipa/ticket/3454

Note: git's --word-diff option is recommended for viewing these changes
Add formerly update-only schema

Some schema was only delivered in updates. Add it back as ldif files.

https://fedorahosted.org/freeipa/ticket/3454
Unify capitalization of attribute names in schema files

Due to a bug[0], python-ldap doesn't parse schema LDIF files correctly
if they use inconsistent capitalization.

This patch works around the bug in IPA schema files.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=1007820

Note: git's --word-diff option is recommended for viewing these changes
Add userClass attribute for users

This new freeform user attribute will allow provisioning systems
to add custom tags for user objects which can be later used for
automember rules or for additional local interpretation.

Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems
https://fedorahosted.org/freeipa/ticket/3588
WebUI: Add userClass attribute to user and host pages

Add userClass attribute to:
- user and host adder dialogs
- user and host detail facets

Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems
https://fedorahosted.org/freeipa/ticket/3590
platform: Add Fedora 19 platform file

Part of: https://fedorahosted.org/freeipa/ticket/3504
ipa-client-install: Publish CA certificate to systemwide store

During the installation, copy the CA certificate to the systemwide
store (/etc/pki/ca-trust/source/anchors/ipa-ca.crt) and update the
systemwide CA database.

This allows browsers to access IPA WebUI without warning out of the
box.

https://fedorahosted.org/freeipa/ticket/3504