KDC: implement transition check for trusted domains
    
    When client principal requests for a ticket for a server principal
    and we have to perform transition, check that all three belong to either
    our domain or the domains we trust through forest trusts.
    
    In case all three realms (client, transition, and server) match
    trusted domains and our domain, issue permission to transition from client
    realm to server realm.
    
    Part of https://fedorahosted.org/freeipa/ticket/3909