Fix delegation-find command --group handling

A wrong way of handling --group DN object caused Internal Error
for this command. Fix that and also provide unit tests to avoid
another regression.

https://fedorahosted.org/freeipa/ticket/3311

ipalib/plugins/aci.py

@@ -801,7 +801,7 @@ class aci_find(crud.Search):
                 groupdn = a.bindrule['expression']
                 groupdn = DN(groupdn.replace('ldap:///',''))
                 try:
-                    cn = groupdn[0]['cn'].value
+                    cn = groupdn[0]['cn']
                 except (IndexError, KeyError):
                     cn = None
                 if cn is None or cn != kw['group']: