DNS Locations: make ipa-ca record generation more robust
    
    __add_ca_records_from_hostname() now skips over DNS exceptions and
    retries resolution until timeout of 120 seconds is reached.
    
    Luckily current logic fails safe: In cases where resolution failed for
    all the CA servers, the resulting zone object will not contain ipa-ca
    record at all and the update logic will skip update for this name.
    I.e. the original values in ipa-ca record set will be left in place.
    
    https://fedorahosted.org/freeipa/ticket/2008
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>