IPA upgrade: move replication ACIs to the mapping tree entry
    
    During IPA server upgrade from pre-4.3 versions, the ACIs permitting
    manipulation of replication agreements are removed from the
    'cn="$SUFFIX",cn=mapping tree,cn=config' and 'cn=o\3Dipaca,cn=mapping
    tree,cn=config'. However they are never re-added breaking management and
    installation of replicas.
    
    This patch modifies the update process so that the ACIs are first added to the
    'cn=mapping tree,cn=config' and then removed from the child entries.
    
    https://fedorahosted.org/freeipa/ticket/5575
    
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>