Amend memberAllowCmd and memberDenyCmd attribute types
    
    Attribute types of attributes designed to hold DN values are not
    supposed to hold own ORDERING or SUBSTR matching rules (which were
    even not correct in this case).
    
    Update these attributes to only define an EQUALITY rule just like
    other DN attribute types in IPA.
    
    https://fedorahosted.org/freeipa/ticket/2866