ipasam: make krbtgt TDO principal canonical
    
    For the trusted domain object for remote realm, we have to use
    krbtgt/REMOTE-FLAT-NAME@OUR-REALM as a canonical name.
    
    Fixes: https://pagure.io/freeipa/issue/9471
    
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Julien Rische <jrische@redhat.com>
    Reviewed-By: Francisco Trivino <ftrivino@redhat.com>