Use only anonymous PKINIT to fetch armor ccache
    
    Since the anonymous principal can only use PKINIT to fetch credential
    cache it makes no sense to try and use its kerberos key to establish
    FAST channel.
    
    We should also be able to use custom PKINIT anchor for the armoring.
    
    https://pagure.io/freeipa/issue/6830
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    Reviewed-By: Martin Basti <mbasti@redhat.com>
    Reviewed-By: Simo Sorce <ssorce@redhat.com>