Allow insecure binds for migration
    
    Commit 5be9341fbabaf7bcb396a2ce40f17e1ccfa54b77 disallowed simple bind
    over an insecure connection. Password logins were only allowed over LDAPS
    or LDAP+STARTTLS. The restriction broke 'ipa migrate-ds' in some cases.
    
    This commit lifts the restriction and permits insecure binds over plain
    LDAP. It also makes the migrate-ds plugin use STARTTLS when a CA
    certificate is configured with a plain LDAP connection.
    
    Fixes: https://pagure.io/freeipa/issue/8040
    Signed-off-by: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Thomas Woerner <twoerner@redhat.com>