Add container and initial ACIs for entitlement support
    
    The entitlement entries themselves will be rather simple, consisting
    of the objectClasses ipaObject and pkiUser. We will just store
    userCertificate in it. The DN will contain the UUID of the entitlement.
    
    ticket #27