Add hbactest command. https://fedorahosted.org/freeipa/ticket/386
    
    HBAC rules control who can access what services on what hosts and from where.
    You can use HBAC to control which users or groups on a source host can
    access a service, or group of services, on a target host.
    
    Since applying HBAC rules implies use of a production environment,
    this plugin aims to provide simulation of HBAC rules evaluation without
    having access to the production environment.
    
     Test user coming from source host to a service on a named host against
     existing enabled rules.
    
     ipa hbactest --user= --srchost= --host= --service=
                  [--rules=rules-list] [--nodetail] [--enabled] [--disabled]
    
     --user, --srchost, --host, and --service are mandatory, others are optional.
    
     If --rules is specified simulate enabling of the specified rules and test
     the login of the user using only these rules.
    
     If --enabled is specified, all enabled HBAC rules will be added to simulation
    
     If --disabled is specified, all disabled HBAC rules will be added to simulation
    
     If --nodetail is specified, do not return information about rules matched/not matched.
    
     If both --rules and --enabled are specified, apply simulation to --rules _and_
     all IPA enabled rules.
    
     If no --rules specified, simulation is run against all IPA enabled rules.
    
    EXAMPLES:
    
        1. Use all enabled HBAC rules in IPA database to simulate:
        $ ipa  hbactest --user=a1a --srchost=foo --host=bar --service=ssh
        --------------------
        Access granted: True
        --------------------
          notmatched: my-second-rule
          notmatched: my-third-rule
          notmatched: myrule
          matched: allow_all
    
        2. Disable detailed summary of how rules were applied:
        $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail
        --------------------
        Access granted: True
        --------------------
    
        3. Test explicitly specified HBAC rules:
        $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule
        ---------------------
        Access granted: False
        ---------------------
          notmatched: my-second-rule
          notmatched: myrule
    
        4. Use all enabled HBAC rules in IPA database + explicitly specified rules:
        $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled
        --------------------
        Access granted: True
        --------------------
          notmatched: my-second-rule
          notmatched: my-third-rule
          notmatched: myrule
          matched: allow_all
    
        5. Test all disabled HBAC rules in IPA database:
        $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled
        ---------------------
        Access granted: False
        ---------------------
          notmatched: new-rule
    
        6. Test all disabled HBAC rules in IPA database + explicitly specified rules:
        $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled
        ---------------------
        Access granted: False
        ---------------------
          notmatched: my-second-rule
          notmatched: my-third-rule
          notmatched: myrule
    
        7. Test all (enabled and disabled) HBAC rules in IPA database:
        $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled
        --------------------
        Access granted: True
        --------------------
          notmatched: my-second-rule
          notmatched: my-third-rule
          notmatched: myrule
          notmatched: new-rule
          matched: allow_all
    
    Only rules existing in IPA database are tested. They may be in enabled or
    disabled disabled state.
    
    Specifying them through --rules option explicitly enables them only in
    simulation run.
    
    Specifying non-existing rules will not grant access and report non-existing
    rules in output.