ipa-kdb: Fix expiration time calculation
    
    Expiration time should be enforced as per policy only for users and only when a
    password change occurs, ina ll other cases we should just let kadmin decide
    whther it is going to set a password expiration time or just leave it empty.
    
    In general service tickts have strong random passwords so they do not need a
    password policy or expiration at all.
    
    https://fedorahosted.org/freeipa/ticket/1839