use FFI call to rpmvercmp function for version comparison
    
    Stop using rpm-python to compare package versions since the implicit NSS
    initialization upon  the module import breaks NSS handling in IPA code. Call
    rpm-libs C-API function via CFFI instead.
    
    Big thanks to Martin Kosek <mkosek@redhat.com> for sharing the code snippet
    that spurred this patch.
    
    https://fedorahosted.org/freeipa/ticket/5572
    
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>