Don't use Class of Service for account activation, use attribute.

To support group-based account disablement we created a Class of Service
where group membership controlled whether an account was active or not.

Since we aren't doing group-based account locking drop that and use
nsaccountlock directly.

ticket 568

install/share/bootstrap-template.ldif

@@ -352,50 +352,12 @@ ipaDefaultEmailDomain: $DOMAIN
 ipaMigrationEnabled: FALSE
 ipaConfigString: AllowNThash
 
-dn: cn=account inactivation,cn=accounts,$SUFFIX
-changetype: add
-description: Lock accounts based on group membership
-objectClass: top
-objectClass: ldapsubentry
-objectClass: cosSuperDefinition
-objectClass: cosClassicDefinition
-cosTemplateDn: cn=cosTemplates,cn=accounts,$SUFFIX
-cosAttribute: nsAccountLock operational
-cosSpecifier: memberOf
-cn: Account Inactivation
-
 dn: cn=cosTemplates,cn=accounts,$SUFFIX
 changetype: add
 objectclass: top
 objectclass: nsContainer
 cn: cosTemplates
 
-dn: cn=cn\=inactivated\,cn\=account inactivation\,cn\=accounts\,$ESCAPED_SUFFIX,cn=cosTemplates,cn=accounts,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: cosTemplate
-objectClass: extensibleobject
-nsAccountLock: True
-cosPriority: 1
-
-dn: cn=inactivated,cn=account inactivation,cn=accounts,$SUFFIX
-changetype: add
-objectclass: top
-objectclass: groupofnames
-
-dn: cn=cn\=activated\,cn\=account inactivation\,cn\=accounts\,$ESCAPED_SUFFIX,cn=cosTemplates,cn=accounts,$SUFFIX
-changetype: add
-objectClass: top
-objectClass: cosTemplate
-objectClass: extensibleobject
-nsAccountLock: False
-cosPriority: 0
-
-dn: cn=Activated,cn=Account Inactivation,cn=accounts,$SUFFIX
-changetype: add
-objectclass: top
-objectclass: groupofnames
-
 # templates for this cos definition are managed by the pwpolicy plugin
 dn: cn=Password Policy,cn=accounts,$SUFFIX
 changetype: add