managed permission updater: Add mechanism to replace SYSTEM permissions
    
    The "Read DNS Entries" permission, which was marked SYSTEM (no associated
    ACI), can now be converted to a regular managed permission.
    
    Add a mechanism for the updater to replace old SYSTEM permissions.
    
    This cannot be done in an update file because we do not want to replace
    V2 permissions with the same name.
    
    Part of the work for: https://fedorahosted.org/freeipa/ticket/4346
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>