Allow Replication Administrators manipulate Winsync Agreements
    
    Replication Administrators members were not able to set up changelog5
    entry in cn=config or list winsync agreements.
    
    To allow reading winsync replicas, the original deny ACI cn=replica
    had to be removed as it prevented admins from reading the entries,
    but just anonymous/authenticated users.
    
    https://fedorahosted.org/freeipa/ticket/4836
    
    Reviewed-By: David Kupka <dkupka@redhat.com>