Display the value of memberOf ACIs in permission plugin.
    
    There were two problems:
    
    1. memberof wasn't in the list of things we looked for in the return value
       from aci_show()
    2. The value wasn't being translated into a group name.
    
    Use the DN class to retrieve the group name from the memberof URI.
    
    Note that I changed the parsing for targetgroup as well. We now save a lookup
    and potentially returning a NotFound if an aci points to a group that no
    longer exists.
    
    https://fedorahosted.org/freeipa/ticket/2100