IPA: fix [capaths] output
the capaths for a single domain should be collected in a single
sub-section in the MIT Kerberos configuration not spread over multiple
one. See the capaths section of the krb5.conf man page for details.
Resolves:
https://fedorahosted.org/sssd/ticket/3103
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
(cherry picked from commit 5e40ba3168e21dbd5fa1812d6f2fc95f508a9e6e)