managed perm updater: Handle case where we changed default ACIs in the past
    
    This handles the case where IPA's default ACIs changed in something else
    than just attribute lists.
    In this case we can narrow the set of ACIs we think the user might be
    upgrading from.
    
    Part of the work for: https://fedorahosted.org/freeipa/ticket/4346
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>