Replication Administrators cannot remove replication agreements
    
    Replication agreement deletion requires read access to DNA range
    setting. The read access was accidently removed during PermissionV2
    refactoring.
    
    Add the read ACI back as a special SYSTEM permission.
    
    https://fedorahosted.org/freeipa/ticket/4848
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>