Support multiple host and service certificates
    
    Update the framework to support multiple host and service
    certificates.
    
    host-mod and service-mod revoke existing certificates that are not
    included in the modified entry.  Using addattr=certificate=... will
    result in no certificates being revoked.
    
    The existing behaviour of host-disable, host-del, service-disable
    and service-del (revoke existing certificate) is preserved but now
    applies to all certificates in the host or service entry.
    
    Also update host-show and service-show to write all the principal's
    certificates to the file given by the ``--out=FILE`` option.
    
    Part of: http://www.freeipa.org/page/V4/User_Certificates
    
    https://fedorahosted.org/freeipa/ticket/4238
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>