Description of problem:

Installing IPA  with a single component for the realm sometimes fails.

It fails because dc=<component> has updates applied before cn=schema so there
are objectclass violations.

The one realm I've confirmed it fails with is TESTRELM. I've tried others,
alphabetically before and after and it installs fine, so I'm not sure what is
different about this.

Normally update entries are sorted by DN such that parents are applied before
children (we sort by length). And cn=schema should be a special case so it is
always applied first.

Version-Release number of selected component (if applicable):

ipa-server-3.0.0-20.el6.x86_64

Steps to Reproduce:
1. ipa-server-install --realm=TESTRELM

Actual results:

Seen in ipa-server-install output near end:

Applying LDAP updates
ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Update failed: Object
class violation: unknown object class "nisDomainObject"