SDAP: add special handling for IPA Kerberos enterprise principal strings
    
    Unfortunately principal aliases with an alternative realm are stored in
    IPA as the string representation of an enterprise principal, i.e.
    name\@alt.realm@IPA.REALM. To allow searches with the plain alias
    'name@alt.realm' the returned value is converted before it is saved to
    the cache.
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>