ipa-kdb: search for password policies globally
    
    With the CoS templates now used to create additional password policies
    per object type that are placed under the object subtrees, DAL driver
    needs to search for the policies in the whole tree.
    
    Individual policies referenced by the krbPwdPolicyReference attribute
    are always searched by their full DN and with the base scope. However,
    when KDC asks a DAL driver to return a password policy by name, we don't
    have any specific base to search. The original code did search by the
    realm subtree.
    
    Fixes https://fedorahosted.org/freeipa/ticket/6561
    
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>