ldap2.has_upg: Raise an error if the UPG definition is not found
    
    The UPG Definition is always present in IPA; if it can not be read
    it's usually caused by insufficient privileges.
    Previously the code assumed the absence of the entry meant that
    UPG is disabled. With granular read permissions, this would mean
    that users that can add users but can't read UPG Definition would
    add users without UPG, and the reason for that would not be very clear.
    It is better to fail early if the definition can't be read.
    
    Raise an error if the UPG Definition is not available. This makes
    read access to it a prerequisite for adding users.
    
    Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>