Currently env variables are handled differently in client and in server modules, we should unify and document how env variables are handled in IPA.

Following opinions were collected offline:

• copy os.environ and don't change it
• blacklist env variables
• whitelist env variables
• keep list of overrides ('PATH': '/usr/bin:/usr/sbin')

Additional info:

• https://github.com/freeipa/freeipa/pull/204
• https://www.securecoding.cert.org/confluence/display/c/ENV03-C.+Sanitize+the+environment+when+invoking+external+programs