ipa-kdb: fix PAC requester check
    
    PAC requester check was incorrect for in-realm S4U operations. It casted
    too wide check which denied some legitimate requests. Fix that by only
    applying rejection to non-S4U unknown SIDs, otherwise S4U2Self request
    issued by the in-realm service against a trusted domain's user would not
    work.
    
    Related: https://pagure.io/freeipa/issue/9083
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Julien Rische <jrische@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>