upgrade: upgrade existing trust agreements to new layout
    
    Existing trust agreements will lack required Kerberos principals and
    POSIX attributes expected to allow Active Directory domain controllers
    to query IPA master over LSA and NETLOGON RPC pipes.
    
    Upgrade code is split into two parts:
     - upgrade trusted domain object to have proper POSIX attributes
     - generate required Kerberos principals for AD DC communication
    
    Fixes: https://pagure.io/freeipa/issue/6077
    (cherry picked from commit 090e09df130f27fb30a986529ef0944383e668e1)
    
    Reviewed-By: Christian Heimes <cheimes@redhat.com>