ipa-kdb: S4U2Proxy target should use a service name without realm
    
    According to new Samba Kerberos tests and [MS-SFU] 3.2.5.2.4
    'KDC Replies with Service Ticket', the target should not include the
    realm.
    
    Fixes: https://pagure.io/freeipa/issue/9031
    
    Pair-programmed-with: Andreas Schneider <asn@redhat.com>
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Signed-off-by: Andreas Schneider <asn@redhat.com>
    Reviewed-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>