Title: #444: Allow nsaccountlock to be searched in user-find commands
nsaccountlock is an operational attribute, not a normal one. I don't like it
being created all the time. You have to request it explicitly if you want to
show status of users, not invent a mechanism to always add it.
See the full comment at
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code