Upgrade: fix replica agreement, fix backported patch

kdb: Use-krb5_pac_full_sign_compat() when available
OTP: fix-data-type-to-avoid-endianness-issue
Upgrade: fix replica agreement
Upgrade: add PKI drop-in file if missing
Use the python-cryptography parser directly in cert-find
Backport test updates

Rely on sssd-krb5 to include SSSD-generated krb5 configuration

Use the OpenSSL certificate parser in cert-find

Rebase ipa to 4.9.12
user or group name: explain the supported format

Revert DNSResolver Fix use of nameservers with ports.

webui IdP: Remove arrow notation due to uglify-js limitation

Rebase ipa to 4.9.11
updates: fix memberManager ACI to allow managers from a specified group
Defer creating the final krb5.conf on clients
Exclude installed policy module file from RPM verification
Spec file: ipa-client depends on krb5-pkinit-openssl

ipa man page format the EXAMPLES section
Fix canonicalization issue in Web UI
Remove idnssoaserial argument from dns zone API.
Warn for permissions with read/write/search/compare and no attrs
Add PKINIT support to ipa-client-install
Generate CNAMEs for TXT+URI location krb records
Vault: fix interoperability issues with older RHEL systems
Fix typo on ipaupgrade.log chmod during RPM %post snipppet

Rebuild to samba 4.17.2.

webui: Allow grace login limit
check_repl_update: in progress is a boolean
Disabling gracelimit does not prevent LDAP binds
Set passwordgracelimit to match global policy on group pw policies

webui: Do not allow empty pagination size

Add end to end integration tests for external IdP

Add explicit dependency for libvert-libev

Preserve user: fix the confusing summary
Only calculate LDAP password grace when the password is expired

Rebase to upstream release 4.9.10