Allow PassSync user to locate and update NT users
    
    Add new PassSync Service privilege that have sufficient access to
    let AD PassSync service search for NT users and update the password.
    To make sure existing PassSync user keeps working, it is added as
    a member of the new privilege.
    
    New update plugin is added to add link to the new privilege to the
    potentially existing PassSync user to avoid breaking the PassSync
    service.
    
    https://fedorahosted.org/freeipa/ticket/4837
    
    Reviewed-By: David Kupka <dkupka@redhat.com>