Add managed read permissions to krbtpolicy
    
    Unlike other objects, the ticket policy is stored in different
    subtrees: global policy in cn=kerberos and per-user policy in
    cn=users,cn=accounts.
    Add two permissions, one for each location.
    
    Also, modify tests so that adding new permissions in cn=users
    doesn't cause failures.
    
    Part of the work for: https://fedorahosted.org/freeipa/ticket/3566