ipa-kdb: use canonical principal in certauth plugin
    
    Currently the certauth plugin use the unmodified principal from the
    request to lookup the user. This might fail if e.g. enterprise
    principals are use. With this patch the canonical principal form the kdc
    entry is used.
    
    Resolves https://pagure.io/freeipa/issue/6993
    
    Reviewed-By: David Kupka <dkupka@redhat.com>