ipa-kdb: Support Windows 2012 Server
    
    Windows 2012 Server changed procedure how KERB_VALIDATION_INFO ([MS-PAC]
    section 2.5) is populated. Detailed description is available in [MS-KILE]
    version 25.0 and above.
    
    Refactor KERB_VALIDATION_INFO verification and ensure we filter out extra
    SIDs in case they belong to our domain.
    
    https://fedorahosted.org/freeipa/ticket/3231