ipa_server_mode: write capaths to krb5 include file
    
    If there are member domains in a trusted forest which are DNS-wise not
    proper children of the forest root the IPA KDC needs some help to
    determine the right authentication path. In general this should be done
    internally by the IPA KDC but this works requires more effort than
    letting sssd write the needed data to the include file for krb5.conf.
    If this functionality is available for the IPA KDC this patch might be
    removed from the sssd tree.
    
    Fixes https://fedorahosted.org/sssd/ticket/2093