permission plugin: Ignore unparseable ACIs
    
    When manipulating a permission for an entry that has an ACI
    that the parser cannot process, skip this ACI instead of
    failing.
    
    Add a test that manipulates permission in cn=accounts,
    where there are complex ipaAllowedOperation-based ACIs.
    
    Workaround for: https://fedorahosted.org/freeipa/ticket/4376
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>