DNS Locations: add ACI for template attribute
    
    DNS Servers and DNS Administrators must have access to
    'idnsTemplateAttribute' to be able set/read template
    for generating CNAME records pointing to proper location records.
    
    Also user must be able to add objectclass for idnsTemplateAttribute
    
    https://fedorahosted.org/freeipa/ticket/2008
    
    Reviewed-By: Petr Spacek <pspacek@redhat.com>
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>