ipa-kdb: when applying ticket policy, do not deny PKINIT
    
    PKINIT differs from other pre-authentication methods by the fact that it
    can be matched indepedently of the user authentication types via certmap
    plugin in KDC.
    
    Since PKINIT is a strong authentication method, allow its authentication
    indicator and only apply the ticket policy.
    
    Fixes: https://pagure.io/freeipa/issue/9485
    
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Francisco Trivino <ftrivino@redhat.com>