Add safe updates for objectClasses
    
    Current objectclass updates in a form of "replace" update instruction
    dependent on exact match of the old object class specification in the
    update instruction and the real value in LDAP. However, this approach is
    very error prone as object class definition can easily differ as for
    example because of unexpected X-ORIGIN value. Such objectclass update
    failures may lead to serious malfunctions later.
    
    When comparing the objectclasses, make sure we normalize them both
    before we compare them to mitigate these kinds of errors. python-ldap's
    objectclass model can be utilized to do the normalization part.
    
    One objectclass update instruction was changed to do a replace of
    an objectclass separately from add update instruction so that we
    really only replace what's stored in LDAP.
    
    https://fedorahosted.org/freeipa/ticket/2440