In sudo when the category is all do not allow members, and vice versa.
    
    This is what we already do in the HBAC plugin, this ports it to Sudo.
    
    If a category (user, host, etc) is u'all' then we don't allow individual
    members be added. Conversely if there are members we don't allow the
    category be set to u'all'.
    
    https://fedorahosted.org/freeipa/ticket/1440