Implement OTP token importing

This patch adds support for importing tokens using RFC 6030 key container
files. This includes decryption support. For sysadmin sanity, any tokens
which fail to add will be written to the output file for examination. The
main use case here is where a small subset of a large set of tokens fails
to validate or add. Using the output file, the sysadmin can attempt to
recover these specific tokens.

This code is implemented as a server-side script. However, it doesn't
actually need to run on the server. This was done because importing is an
odd fit for the IPA command framework:
1. We need to write an output file.
2. The operation may be long-running (thousands of tokens).
3. Only admins need to perform this task and it only happens infrequently.

https://fedorahosted.org/freeipa/ticket/4261

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Fix packaging issue with doubly specified directories

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add missing ipa-otptoken-import.1.gz to spec file

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Change OTPSyncRequest structure to use OctetString

This change has two motivations:
  1. Clients don't have to parse the string.
  2. Future token types may have new formats.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
trusts: Add more read attributes

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
trusts: Allow reading system trust accounts by adtrust agents

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
webui-ci: adjust tests to dns changes

All DNS Zone names must be fully qualified.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: fix field's default value

Fields with default value, such as DNS Zone's idnsforwardpolicy, were
marked as dirty when no value was loaded and when default value of
input control was other than empty.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: don't limit permission search in privileges

Search for privileges was limited to bindruletype==permission. There
was no reason to do that.

This patch removes the restriction.

Related to:
https://fedorahosted.org/freeipa/ticket/4079

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Fix incompatible DNS permission

dns(forward)zone-add/remove-permission can work with permissions with
relative zone name

Ticket:https://fedorahosted.org/freeipa/ticket/4383

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: PEP8 fixes in sudorule.py

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: Allow using hostmasks for setting allowed hosts

Adds a new --hostmasks option to sudorule-add-host and sudorule-remove-host
commands, which allows setting a range of hosts specified by a hostmask.

https://fedorahosted.org/freeipa/ticket/4274

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: Allow using external groups as groups of runAsUsers

Adds a new attribute ipaSudoRunAsExtUserGroup and corresponding hooks
sudorule plugin.

https://fedorahosted.org/freeipa/ticket/4263

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: Make sure sudoRunAsGroup is dereferencing the correct attribute

Makes sure we dereference the correct attribute. Also adds object class
checking.

https://fedorahosted.org/freeipa/ticket/4324

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: Include externalhost and ipasudorunasextgroup in the list of default attributes

The following attributes were missing from the list of default attributes:

* externalhost
* ipasudorunasextuser
* ipasudorunasextgroup

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: Allow adding deny commands when command category set to ALL

https://fedorahosted.org/freeipa/ticket/4340

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: Make sure all the relevant attributes are checked when setting category to ALL

https://fedorahosted.org/freeipa/ticket/4341

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: Fix the order of the parameters to have less chaotic output

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
sudorule: Enforce category ALL checks on dirsrv level

https://fedorahosted.org/freeipa/ticket/4341

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: test_sudo: Add tests for allowing hosts via hostmasks

Reviewed-By: Petr Viktorin <pviktori@redhat.com>