Defer conversion and validation until after --{add,del,set}attr are handled
    
    --addattr & friends that modified attributes known to Python sometimes
    used converted and validated Python values instead of LDAP strings.
    This caused a problem for --delattr, which searched for a converted
    integer in a list of raw strings (ticket 2407).
    With this patch we work on raw strings, converting only when done.
    
    Deferring validation ensures the end result is valid, so proper errors
    are raised instead of failing later (ticket 2405).
    
    Tests included.
    
    Replaces previous fix for:
    https://fedorahosted.org/freeipa/ticket/2418
    
    Fixes:
    https://fedorahosted.org/freeipa/ticket/2405
    https://fedorahosted.org/freeipa/ticket/2407
    https://fedorahosted.org/freeipa/ticket/2408