Collect memberof information for sudo commands.

We weren't searching the cn=sudo container so all members of a
sudocmdgroup looked indirect.

Add a label for sudo command groups.

Update the tests to include verifying that membership is done
properly.

ticket 1003

ipaserver/plugins/ldap2.py

@@ -1002,6 +1002,14 @@ class ldap2(CrudBackend, Encoder):
         except errors.NotFound:
             pbacresults = []
         results = results + pbacresults
+        try:
+            (sudoresults, truncated) = self.find_entries(searchfilter,
+                attr_list, 'cn=sudo,%s' % api.env.basedn,
+                time_limit=time_limit, size_limit=size_limit,
+                normalize=normalize)
+        except errors.NotFound:
+            sudoresults = []
+        results = results + sudoresults
 
         direct = []
         indirect = []