Update SELinux policy for dogtag10
    
    Incorporate SELinux policy changes introduced in Dogtag 10 in IPA
    SELinux policy:
    - dogtag10 now runs with pki_tomcat_t context instead of pki_ca_t
    - certmonger related rule are now integrated in system policy and
      can be removed from IPA policy
    
    Also remove redundant SELinux rules for connection of httpd_t, krb5kdc_t
    or named_t to DS socket. The socket has different target type anyway
    (dirsrv_var_run_t) and the policy allowing this is already in
    system.
    
    https://fedorahosted.org/freeipa/ticket/3234