ipa-kdb: when processing transitions, hand over unknown ones to KDC
    
    When processing cross-realm trust transitions, let the KDC to handle
    those we don't know about. Admins might define the transitions as
    explicit [capaths] in krb5.conf.
    
    https://fedorahosted.org/freeipa/ticket/4791
    
    Reviewed-By: Sumit Bose <sbose@redhat.com>
    Reviewed-By: Simo Sorce <ssorce@redhat.com>