updates: fix memberManager ACI to allow managers from a specified group
    
    The original implementation of the member manager added support for both
    user and group managers but left out upgrade scenario. This means when
    upgrading existing installation a manager whose rights defined by the
    group membership would not be able to add group members until the ACI is
    fixed.
    
    Remove old ACI and add a full one during upgrade step.
    
    Fixes: https://pagure.io/freeipa/issue/9286
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>