Fill new DNS zone update policy by default
    
    For security reasons, dynamic updates are not enabled for new DNS
    zones. In order to enable the dynamic zone securely, user needs to
    allow dynamic updates and create a zone update policy.
    
    The policy is not easy to construct for regular users, we should
    rather fill it by default and let users just switch the policy
    on or off.
    
    https://fedorahosted.org/freeipa/ticket/2441