Fix: Add managed read permissions for compat tree and operational attrs
    
    This is a fix for an earlier version, which was committed by mistake as:
    master: 418ce870bfbe13cea694a7b862cafe35c703f660
    ipa-4-0: 3e2c86aeabbd2e3c54ad73a40803ef2bf5b0cb17
    ipa-4-1: 9bcd88589e30d31d3f533cd42d2f816ef01b07c7
    
    Thanks to Alexander Bokovoy for contributions
    
    https://fedorahosted.org/freeipa/ticket/4521