ipatests: ensure auth indicators can't be added to internal IPA services
    
    Authentication indicators should not be added to internal IPA services,
    since this can lead to a broken IPA setup. In case a client with
    an auth indicator set in its host principal, promoting it to a replica
    should fail.
    
    Related: https://pagure.io/freeipa/issue/8206
    Signed-off-by: Antonio Torres <antorres@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Christian Heimes <cheimes@redhat.com>