Allow anonymous read access to containers

All nsContainer objects, except ones in cn=etc, can now be read anonymously.
The allowed attributes are cn and objectclass.
These are the same in all IPA installations so they don't provide
any sensitive information.

Also, $SUFFIX itself can now be read anonymously.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
ipa-pwd-extop: Deny LDAP binds for accounts with expired principals

Adds a check for krbprincipalexpiration attribute to pre_bind operation
in ipa-pwd-extop dirsrv plugin. If the principal is expired, auth is
denied and LDAP_UNWILLING_TO_PERFORM along with the error message is
sent back to the client. Since krbprincipalexpiration attribute is not
mandatory, if there is no value set, the check is passed.

https://fedorahosted.org/freeipa/ticket/3305
ipatests: legacy clients: Do not use external hostnames for testing login to legacy clients from master
ipatests: Fix apache semaphores prior to installing IPA server
ipatests: tasks: Accept extra arguments when installing client
ipatests: Do not reconfigure Host's hostname

When creating a BaseHost instance, the machine's hostname was
reconfigured to have the same shortname prepended the domain name
of the domain where it was defined.

However, it makes sense in certain use cases to define hosts
that have hostnames other than belonging directly in the domain
they were defined in. This is especially true with the introduction
of the concept of the external hostname.
ipatests: Fix incorrect UID/GID reference for subdomain users and groups

In legacy client integration test, the test cases that query information
from subdomain about subdomain users and group expected subdomain
users and groups to have the UIDs/GIDs as users and groups in the root
domain.
ipatests: Add Sudo integration test