Fix: Missing ACI for records in 40-dns.update

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Restore privileges after forward zones update

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
ldapupdate: Restore 'replace' functionality

The replace directive was made a no-op by mistake in commit 6381d76.
Restore it.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Allow read access to services in cn=masters to auth'd users

https://fedorahosted.org/freeipa/ticket/4425

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Allow to add managed permission for reverse zones

Ticket: https://fedorahosted.org/freeipa/ticket/4422
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
webui: new navigation structure

https://fedorahosted.org/freeipa/ticket/4418

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Test DNS: test zone normalization

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Test DNS: TLSA record

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Test DNS: add zone with consecutive dash characters

Test for ticket: https://fedorahosted.org/freeipa/ticket/4268

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Prepare spec for 4.0 release

- Bump 389-ds-base requires to fix the deref call with new ACIs:
  https://fedorahosted.org/freeipa/ticket/4389
- Bump bind-dyndb-ldap Conflicts to fetch the DNSSEC capability
- Bump selinux-policy to fix the CRL retrieval:
  https://fedorahosted.org/freeipa/ticket/4369
- Remove conditionals for Fedora < 20 as FreeIPA 4.0 is not planned
  to be released on these platforms.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
makeaci: Use the DN where the ACI is stored, not the permission's DN

Reviewed-By: Martin Basti <mbasti@redhat.com>