service: enforce keytab user when retrieving the keytab
    
    HTTP service uses different user for keytab ownership than the service
    user. On Fedora this leads to http.keytab being owned by 'apache' user
    after IPA deployment while it should be owned by 'root' to allow
    GSSPROXY configuration to work correctly.
    
    The situation is fixed during upgrade (ipa-server-upgrade) but it means
    for new deployments there might be a period of unexplained Web UI
    authentication failures.
    
    Fixes: https://pagure.io/freeipa/issue/8872
    
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Signed-off-by: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Christian Heimes <cheimes@redhat.com>