Update 'caacl' plugin to support lightweight CAs
    
    For backwards compatibility, an ACL that has no CAs and no CA
    category allows access to the IPA CA (host authority) only.
    
    Part of: https://fedorahosted.org/freeipa/ticket/4559
    
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>