When using ipaExternalGroup/ipaExternalMember attributes it is
possible to add group members which don't exist in IPA database.
This is primarily is required for AD trusts support and therefore
validation is accepting only secure identifier (SID) format.

https://fedorahosted.org/freeipa/ticket/2664

When unknown keyword arguments are passed to a Command, raise an
error instead of ignoring them.

Options used when IPA calls its commands internally are listed
in a new Command attribute called internal_options, and allowed.

Previous patches (0b01751c, c45174d6, c5689e7f) made IPA not use
unknown keyword arguments in its own commands and tests, but since
that some violations were reintroduced in permission_find and tests.
Fix those.

Tests included; both a frontend unittest and a XML-RPC test via the
ping plugin (which was untested previously).

https://fedorahosted.org/freeipa/ticket/2509

dnsrecord_add interactive mode did not work correctly when more
than one DNS record part was entered as command line option. It
asked for remaining options more than once. This patch fixes
this situation and also adds tests to cover this use case
properly.

https://fedorahosted.org/freeipa/ticket/2641

Currently, each DNS test case first checks if DNS is configured
by creating and deleting a test zone. This takes quite a lot of time.

This patch moves the check to the setUpClass method, so the check is
only done once for all the tests.

Similarly, if the server is not available, entire XMLRPC test classes
are now skipped.

Additionally, CLItests that hit the server are skipped if the server
isn't available.

These test that command lines are parsed to correct Command arguments.
Includes some tests for interactive prompts.

To make this possible cli.run is broken up into several pieces.