ipatests: Test MemberManager ACI to allow managers from a specified group after upgrade scenario
    
    Testing if manager whose rights defined by the group membership
    is able to add group members, after upgrade of ipa server.
    Using ACI modification to demonstrate unability before upgrading
    ipa server.
    Related: https://pagure.io/freeipa/issue/9286
    
    Also added some generally helpful functions to tasks.py
    
    Signed-off-by: Erik Belko <ebelko@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
    Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
    Reviewed-By: Michal Polovka <mpolovka@redhat.com>