Fix: Add managed read permissions for compat tree and operational attrs

This is a fix for an earlier version, which was committed by mistake as:
master: 418ce870bf
ipa-4-0: 3e2c86aeab
ipa-4-1: 9bcd88589e

Thanks to Alexander Bokovoy for contributions

https://fedorahosted.org/freeipa/ticket/4521

ipalib/plugins/group.py

@@ -204,12 +204,12 @@ class group(LDAPObject):
         },
         'System: Read Group Compat Tree': {
             'non_object': True,
-            'ipapermbindruletype': 'all',
+            'ipapermbindruletype': 'anonymous',
             'ipapermlocation': api.env.basedn,
             'ipapermtarget': DN('cn=groups', 'cn=compat', api.env.basedn),
             'ipapermright': {'read', 'search', 'compare'},
             'ipapermdefaultattr': {
-                'objectclass', 'cn', 'memberuid',
+                'objectclass', 'cn', 'memberuid', 'gidnumber',
             },
         },
     }