Add checks to prevent adding auth indicators to internal IPA services
    
    Authentication indicators should not be enforced against internal
    IPA services, since not all users of those services are able to produce
    Kerberos tickets with all the auth indicator options. This includes
    host, ldap, HTTP and cifs in IPA server and cifs in IPA clients.
    If a client that is being promoted to replica has an auth indicator
    in its host principal then the promotion is aborted.
    
    Fixes: https://pagure.io/freeipa/issue/8206
    Signed-off-by: Antonio Torres <antorres@redhat.com>