ipa-kdb: honor SID from the host or service entry
    
    If the SID was explicitly set for the host or service entry, honor it
    when issuing PAC. For normal services and hosts we don't allocate
    individual SIDs but for cifs/... principals on domain members we do as
    they need to login to Samba domain controller.
    
    Related: https://pagure.io/freeipa/issue/9031
    
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>