Allow read access to masters, but not their services, to auth'd users
    
    The ipa host-del command checks if the host to be deleted is an
    IPA master by looking up the entry in cn=masters.
    If the entry is not accessible, host-del would proceed to delete
    the host.
    Thus we need to allow reading the master entries to at least
    those that can delete hosts.
    Since the host information is also available via DNS, it makes
    no sense be extremely secretive about it.
    
    Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>