upgrade: upgrade existing trust agreements to new layout
    
    Existing trust agreements will lack required Kerberos principals and
    POSIX attributes expected to allow Active Directory domain controllers
    to query IPA master over LSA and NETLOGON RPC pipes.
    
    Upgrade code is split into two parts:
     - upgrade trusted domain object to have proper POSIX attributes
     - generate required Kerberos principals for AD DC communication
    
    Fixes: https://pagure.io/freeipa/issue/6077
    Reviewed-By: Christian Heimes <cheimes@redhat.com>