IPA certauth plugin
    
    This patch add a certauth plugin which allows the IPA server to support
    PKINIT for certificates which do not include a special SAN extension
    which contains a Kerberos principal but allow other mappings with the
    help of SSSD's certmap library.
    
    Related to https://pagure.io/freeipa/issue/4905
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: David Kupka <dkupka@redhat.com>