Support requests with SAN in cert-request.
    
    For each SAN in a request there must be a matching service entry writable by
    the requestor. Users can request certificates with SAN only if they have
    "Request Certificate With SubjectAltName" permission.
    
    https://fedorahosted.org/freeipa/ticket/3977
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>