Allow permissions with 'self' bindruletype

Make it possible to create a managed permission with
ipapermbindruletype="self". The ACI will have bind rule
'(userdn = "ldap:///self")'.

Example
-------

Allow users to modify their own fasTimezone and fasIRCNick attributes:

```
managed_permissions = {
    "System: Self-Modify FAS user attributes": {
        "ipapermright": {"write"},
        "ipapermtargetfilter": ["(objectclass=fasuser)"],
        "ipapermbindruletype": "self",
        "ipapermdefaultattr": ["fasTimezone", "fasIRCNick"],
    }
}
```

See: https://github.com/fedora-infra/freeipa-fas/pull/107
Fixes: https://pagure.io/freeipa/issue/8348
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

ipaserver/plugins/permission.py

@@ -279,8 +279,8 @@ class permission(baseldap.LDAPObject):
             label=_('Bind rule type'),
             doc=_('Bind rule type'),
             autofill=True,
-            values=(u'permission', u'all', u'anonymous'),
-            default=u'permission',
+            values=('permission', 'all', 'anonymous', 'self'),
+            default='permission',
             flags={'allow_mod_for_managed_permission'},
         ),
         DNOrURL(
@@ -600,6 +600,8 @@ class permission(baseldap.LDAPObject):
             bindrule = 'userdn = "ldap:///all"'
         elif ipapermbindruletype == 'anonymous':
             bindrule = 'userdn = "ldap:///anyone"'
+        elif ipapermbindruletype == 'self':
+            bindrule = 'userdn = "ldap:///self"'
         else:
             raise ValueError(ipapermbindruletype)