Disallow setattr on no_update/no_create params
    
    Make --{set,add,del}attr fail on parameters with the no_update/no_create
    flag for the respective command.
    
    For attributes that can be modified, but we just don't want to display
    in the CLI, use the 'no_option' flag. These are "locking" attributes
    (ipaenabledflag, nsaccountlock) and externalhost.
    
    Document the 'no_option' flag. Add some tests.
    
    https://fedorahosted.org/freeipa/ticket/2580