caacl: fix regression in rule instantiation
    
    The Principal refactor causes service collections
    ('memberservice_service' attribute) to return Principal objects
    where previously it returned strings, but the HBAC machinery used
    for CA ACL enforcement only handles strings.  Update the code to
    stringify service Principal objects when adding them to HBAC rules.
    
    Fixes: https://fedorahosted.org/freeipa/ticket/6146
    Reviewed-By: Martin Basti <mbasti@redhat.com>