Figure out CLA story

[relrod]

There's a few things here:

1. We want to make everything related to the CLA optional, as not every project will use it.
2. Having CLA groups with 41k members in them, as in Fedora's FAS, makes IPA slow to a crawl.

I'm thinking this could be part of freeipa-fas, a simple boolean attribute on fasuser.

The idea would be:

Show a flash when the user logs in, saying "Hey, you haven't signed the CLA. If you're planning to contribute $projectname, please do so at LINK." and then if a sponsor tries to add a user to a group and that user doesn't have the CLA bool set, don't let them.