DNS upgrade: change global forwarding policy in LDAP to "only" if private IPs are used
    
    This change is necessary to override automatic empty zone configuration
    in latest BIND and bind-dyndb-ldap 9.0+.
    
    This procedure is still not complete because we need to handle global
    forwarders in named.conf too (independently on each server).
    
    https://fedorahosted.org/freeipa/ticket/5710
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>