PKI service restart after CA renewal failed

Fix both the service restart procedure and registration of old
pki-cad well known service name.

This patch was adapted from original patch of Jan Cholasta 178 to
fix ticket 4092.

https://fedorahosted.org/freeipa/ticket/4092
Revert restart scripts file permissions change

Previous commit accidentally added executable permission to
restart_pkicad and stop_pkicad.
hbactest does not work for external users

Original patch for ticket #3803 implemented support to resolve SIDs
through SSSD. However, it also broke hbactest for external users. The
result of the updated external member group search must be local
non-external groups, not the external ones. Otherwise the rule is not
matched.

https://fedorahosted.org/freeipa/ticket/3803
Add rpmbuild/ to .gitignore
Rename LDAPEntry method commit to reset_modlist.

https://fedorahosted.org/freeipa/ticket/3488
Use old entry state in LDAPClient.update_entry.

https://fedorahosted.org/freeipa/ticket/3488
Move LDAPClient method get_single_value to IPASimpleLDAPObject.

Refactor IPASimpleLDAPObject methods get_syntax and get_single_value.

https://fedorahosted.org/freeipa/ticket/3488
Make IPASimpleLDAPObject.get_single_value result overridable.

Add some default overrides.

https://fedorahosted.org/freeipa/ticket/3488
Use LDAPClient.update_entry for LDAP mods in ldapupdate.

Remove legacy IPAdmin methods generateModList and updateEntry.

https://fedorahosted.org/freeipa/ticket/3488
Reduce amount of LDAPEntry.reset_modlist calls in ldapupdate.

https://fedorahosted.org/freeipa/ticket/3488
Add LDAPEntry method generate_modlist.

Use LDAPEntry.generate_modlist instead of LDAPClient._generate_modlist and
remove LDAPClient._generate_modlist.

https://fedorahosted.org/freeipa/ticket/3488
Remove unused LDAPClient methods get_syntax and get_single_value.

https://fedorahosted.org/freeipa/ticket/3488
Remove legacy LDAPEntry properties data and orig_data.

https://fedorahosted.org/freeipa/ticket/3488
Store old entry state in dict rather than LDAPEntry.

https://fedorahosted.org/freeipa/ticket/3488
Do not crash on bad LDAP data when formatting decode error message.

https://fedorahosted.org/freeipa/ticket/3488
Use raw LDAP data in ldapupdate.

https://fedorahosted.org/freeipa/ticket/3488