Restore ACI when aci_mod fails
    
    aci_mod command is composed of 2 ACI commands: aci_del which
    deletes the old ACI and aci_add which adds the new modified ACI.
    However, if aci_add command fails then both new and the old ACI
    are lost. Old ACI must be restored in this case.
    
    https://fedorahosted.org/freeipa/ticket/2013
    https://fedorahosted.org/freeipa/ticket/2014