ipa/client: add site-wide & host-based sudo rules
    
    This also uses HBAC to let all IPA accounts use the sudo command, so
    what some user or group may use it for just has to be configured with
    sudo rules in IPA.
    
    Signed-off-by: Nils Philippsen <nils@redhat.com>