Return a copy of cached entries, only with requested attributes
    
    Some plugins, notably dns, modifies a returned entry in order
    to compare it to the user-provided info (e.g. dnsrecord-del).
    This modification was done on the cached entry directly rather
    than a copy which caused unexpected results, mostly
    EmptyResult because the cached entry was changed directly so
    the next get_entry returned the same modified entry.
    
    In addition, on a hit in the LDAP cache the entire cached entry
    was returned regardless of what attributes were requested.
    
    The automember condition add/remove calls only request the
    inclusive/exclusive rule attributes and loop over the returned
    values to look for duplicates. This was failing because the queried
    entry contains attributes that the candidate entry does not contain.
    The automember code is:
    
        old_entry = ldap.get_entry(dn, [attr])
        for regex in old_entry.keys():
            if not isinstance(entry_attrs[regex], (list, tuple)):
    
    old_entry, returned from the cache, contained objectclass, cn,
    description, etc. which don't exist in the candidate entry so
    entry_attrs[regex] threw a KeyError.
    
    To return a copy of the entry and requested attributes on a
    search HIT.
    
    Also be more careful when storing the attributes in the cache entry.
    The returned attributes may not match the requested. So store the
    attributes we actually have.
    
    This issue was exposed by Ansible which maintains a larger and
    longer-lived cache because commands are executed in the server context
    one after another, giving the cache a chance to build up.
    
    Adjust the expected test results as well. In test_get_testuser()
    the first request asks for all attributes (default) so ensure
    that is successful since a user_add gets all attributes in
    the post_callback. Next request a subset of the attributes which
    is also a hit and confirm that only those requested were returned.
    
    https://pagure.io/freeipa/issue/8897
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Stanislav Levin <slev@altlinux.org>
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>