ACI: grant access to admins group instead of admin user
    
    The ACI needed for staged users and deleted users were granted
    only to the uid=admin user. They should rather be granted to
    cn=admins group, to make sure that all members of the admins
    group are able to call the command ipa user-del --preserve.
    
    This commit also adds integration test for non-regression.
    
    https://pagure.io/freeipa/issue/7342
    
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>