Add API to delete a service principal key, service-disable.
    
    I have to do some pretty low-level LDAP work to achieve this. Since
    we can't read the key using our modlist generator won't work and lots of
    tricks would be needed to use the LDAPUpdate object in any case.
    
    I pulled usercertificate out of the global params and put into each
    appropriate function because it makes no sense for service-disable.
    
    This also adds a new variable, has_keytab, to service/host_show output.
    This flag tells us whether there is a krbprincipalkey.