extdom: improve cert request
    
    Certificates can be assigned to multiple user so the extdom plugin must
    use sss_nss_getlistbycert() instead of sss_nss_getnamebycert() and
    return a list of fully-qualified user names.
    
    Due to issues on the SSSD side the current version of lookups by
    certificates didn't work at all and the changes here won't break
    existing clients.
    
    Related to https://pagure.io/freeipa/issue/6826
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: David Kupka <dkupka@redhat.com>