ipaserver/dcerpc.py: if search of a closest GC failed, try to find any GC

https://fedorahosted.org/freeipa/ticket/4458

Reviewed-By: Sumit Bose <sbose@redhat.com>
ipaserver/dcerpc.py: make PDC discovery more robust

Certain operations against AD domain controller can only be done if its
FSMO role is primary domain controller. We need to use writable DC and
PDC when creating trust and updating name suffix routing information.

https://fedorahosted.org/freeipa/ticket/4479

Reviewed-By: Sumit Bose <sbose@redhat.com>
ipaserver/dcerpc.py: Avoid hitting issue with transitive trusts on Windows Server prior to 2012

http://msdn.microsoft.com/en-us/library/2a769a08-e023-459f-aebe-4fb3f595c0b7#id83

Reviewed-By: Sumit Bose <sbose@redhat.com>
ipaserver/dcerpc.py: be more open to what domains can be seen through the forest trust

https://fedorahosted.org/freeipa/ticket/4463

Reviewed-By: Sumit Bose <sbose@redhat.com>
ipaserver/dcerpc.py: Make sure trust is established only to forest root domain

Part of https://fedorahosted.org/freeipa/ticket/4463

Reviewed-By: Sumit Bose <sbose@redhat.com>