Ticket 47395 47397 v2 correct behaviour of account policy if only stateattr
    	is configured or no alternate attr is configured
    
    Bug Description:  The tickets relate to two specific configurations of
    	the account policy plugin
    	1] if createtimestamp is configured as stateattr it is treated like a
    	   normal timstamp attribute and is updated, which should not happen.
    	   As a side effect the account is not locked out based on the original
    	   createtimestamp
    	2] if no altstateattr is configured, always createtimestamp is used, but
    	   the intention was to base account inactivation only on lastlogintime
    
    Fix Description:   1] prevent update of createtimestamp, even if used as stateattr
    		   2] if no altstateattr is configured still use the default, but
    		      accept "1.1" as null value and check only stateattr
    
    https://fedorahosted.org/389/ticket/47395
    https://fedorahosted.org/389/ticket/47397
    
    Reviewed by: ?
    (cherry picked from commit b4cc0f6b31d8221677950a703a78b02e0cbc7e30)