httpinstance: add fqdn and ipa-ca alias to Certmonger request
    
    BACKGROUND:
    
    We are implementing ACME support in FreeIPA (umbrella ticket:
    https://pagure.io/freeipa/issue/4751).  ACME is defined in RFC 8555.
    HTTPS is REQUIRED (https://tools.ietf.org/html/rfc8555#section-6.1).
    Therefore, every FreeIPA server that provides the ACME service
    capability must be reachable by HTTPS.
    
    RFC 8555 does not say anything about which port to use for ACME.
    The default HTTPS port of 443 is implied.  Therefore, the FreeIPA
    ACME service will be reached via the Apache httpd server, which will
    be the TLS server endpoint.
    
    As a usability affordance for ACME clients, and as a maintainability
    consideration i.e. to allow the topology to change without having to
    reconfigure ACME clients, there should be a a single DNS name used
    to reach the IPA ACME service.
    
    The question then, is which DNS name to use.
    
    REQUIREMENTS:
    
    Each FreeIPA server that is also an ACME server must:
    
    1. Be reachable via a common DNS name
    
    2. Have an HTTP service certificate with that DNS name as a SAN
       dNSName value
    
    DESIGN CONSIDERATION - WHAT DNS NAME TO USE?:
    
    Some unrelated FreeIPA ACME design decisions provide important
    context for the DNS name decision:
    
    - The ACME service will be automatically and unconditionally
      deployed (but not necessarily *enabled*) on all CA servers.
    
    - Enabling or disabling the ACME service will have topology-wide
      effect, i.e. the ACME service is either enabled on all CA
      servers, or disabled on all CA servers.
    
    In a CA-ful FreeIPA deployment there is already a DNS name that
    resolves to all CA servers: ``ipa-ca.$DOMAIN``, e.g.
    ``ipa-ca.example.com``.  It is expected to point to all CA servers
    in the deployment, and *only* to CA servers.  If internal DNS is
    deployed, the DNS records for ``ipa-ca.$DOMAIN`` are created and
    updated automatically.  If internal DNS is not deployed,
    administrators are required to maintain these DNS records
    themselves.
    
    The ``ipa-ca.$DOMAIN`` alias is currently used for OCSP and CRL
    access.  TLS is not required for these applications (and it can
    actually be problematic for OCSP).  Enabling TLS for this name
    presents some risk of confusion for operators.  For example, if they
    see that TLS is available and alter the certificate profiles to
    include an HTTPS OCSP URL in the Authority Information Access (AIA)
    extension, OCSP-using clients may fail to validate such
    certificates.  But it is possible for administrators to make such a
    change to the profile, whether or not HTTPS is available.
    
    One big advantage to using the ``ipa-ca.$DOMAIN`` DNS name is that
    there are no new DNS records to manage, either in the FreeIPA
    implementation or for administrators in external DNS systems.
    
    The alternative approach is to define a new DNS name, e.g.
    ``ipa-acme.$DOMAIN``, that ACME clients would use.  For internal
    DNS, this means the FreeIPA implementation must manage the DNS
    records.  This is straightforward; whenever we add or remove an
    ``ipa-ca.$DOMAIN`` record, also add/remove the ``ipa-acme.$DOMAIN``
    record.  But for CA-ful deployments using external DNS, it is
    additional work for adminstrators and, unless automated, additional
    room for error.
    
    An advantage of using a different DNS name is ``ipa-ca.$DOMAIN`` can
    remain inaccessible over HTTPS.  This possibly reduces the risk of
    administrator confusion or creation of invalid AIA configuration in
    certificate profiles.
    
    Weighing up the advantages and disadvantages, I decided to use the
    ``ipa-ca.$DOMAIN`` DNS name.
    
    DESIGN CONSIDERATION - CA SERVERS, OR ALL SERVERS?:
    
    A separate decision from which name to use is whether to include it
    on the HTTP service certificate for ACME servers (i.e. CA servers)
    only, or on all IPA servers.
    
    Combined with the assumption that the chosen DNS name points to CA
    servers *only*, there does not seem to be any harm in adding it to
    the certificates on all IPA servers.
    
    The alternative is to only include the chosen DNS name on the HTTP
    service certificates of CA servers.  This approach entails some
    additional complexity:
    
    - If a non-CA replica gets promoted to CA replica (i.e. via
      ``ipa-ca-install``), its HTTP certificate must be re-issued with
      the relevant name.
    
    - ipa-server-upgrade code must consider whether the server is a CA
      replica when validating (and if necessary re-creating) Certmonger
      tracking requests
    
    - IPA Health Check must be made aware of this factor when checking
      certificates and Certmonger tracking requests.
    
    Weighing up the options, I decided to add the common DNS name to the
    HTTP service certificate on all IPA servers.  This avoids the
    implementation complexity discussed above.
    
    CHANGES IN THIS COMMIT
    
    When (re-)tracking the HTTP certificate, explicitly add the server
    FQDN and ipa-ca.$DOMAIN DNS names to the Certmonger tracking request.
    
    Related changes follow in subsequent commits.
    
    Part of: https://pagure.io/freeipa/issue/8186
    
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>