Fix DNS permissions and membership in privileges
    
    This resolves two issues:
    
    1. The DNS acis lacked a prefix so weren't tied to permissions
    2. The permissions were added before the privileges so the member
       values weren't calculated properly
    
    For updates we need to add in the members and recalculate memberof via
    a DS task.
    
    https://fedorahosted.org/freeipa/ticket/1898