ipa-kdb: Use proper account flags for Kerberos principal in PAC
    
    As part of CVE-2020-25717 mitigations, Samba expects correct user
    account flags in the PAC. This means for services and host principals we
    should be using ACB_WSTRUST or ACB_SVRTRUST depending on whether they
    run on IPA clients ("workstation" or "domain member") or IPA servers
    ("domain controller").
    
    Fixes: https://pagure.io/freeipa/issue/9031
    
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>