permission plugin: Join --type objectclass filters with OR
    
    For groups, we will need to filter on either posixgroup (which UPGs
    have but non-posix groups don't) and groupofnames/nestedgroup
    (which normal groups have but UPGs don't).
    Join permission_filter_objectclasses with `|` and add them as
    a single ipapermtargetfilter value.
    
    Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>