server install: fix KDC certificate validation in CA-less
    
    Verify that the provided certificate has the extended key usage and subject
    alternative name required for KDC.
    
    https://pagure.io/freeipa/issue/6831
    https://pagure.io/freeipa/issue/6869
    
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>