Improve default user/group object class validation
    
    When user/group default object class is being modified via
    ipa config-mod, no validation check is run. Check at least
    the following:
    
    - all object classes are known to LDAP
    - all default user/group attributes are allowed under the new
      set of default object classes
    
    https://fedorahosted.org/freeipa/ticket/1893