ipa user-find --manager does not find matches
    
    The manager LDAP attribute is a dn pointing inside the user
    container. When passed on the command it is typically a bare user
    uid. The search filter will only succeed if the bare uid is converted
    to a full dn because that is what is stored in the value for the
    manager attribute.
    
    The search failure is solved by calling _normalize_manager() which
    does the conversion to a dn (if not already a dn).
    
    It feels like this type of conversion should be performed in the pre
    callback which allows one to modify the filter. But when the pre
    callback is invoked it's complex string with the manager attribute
    already inserted. This is because the LDAPSearch.execute() method
    processes the options dict and constructs a filter component for each
    key/value in the options dict prior to invoking the pre callback. If
    we wanted to modify the manager value in the filter in the pre
    callback we would have to decompose the filter string, perform dn
    checking and then reassemble the filter. It's much cleaner to perform
    the dn operations on the manager value before it gets embedded into
    what otherwise might be a very complex filter. This is the reason why
    the normalization is perfored in the execute method as opposed to the
    pre callback. Other classes do similar things in their execute methods
    as opposed to their callbacks's, selinuxusermap_find is one example.
    
    Patch also introduces new unit test to verify.
    
    https://fedorahosted.org/freeipa/ticket/2264