Add PKINIT support to ipa-client-install
    
    The ``ipa-client-install`` command now supports PKINIT for client
    enrollment. Existing X.509 client certificates can be used to
    authenticate a host.
    
    Also restart KRB5 KDC during ``ipa-certupdate`` so KDC picks up new CA
    certificates for PKINIT.
    
    *Requirements*
    
    - The KDC must trust the CA chain of the client certificate.
    - The client must be able to verify the KDC's PKINIT cert.
    - The host entry must exist. This limitation may be removed in the
      future.
    - A certmap rule must match the host certificate and map it to a single
      host entry.
    
    *Example*
    
    ```
    ipa-client-install \
        --pkinit-identity=FILE:/path/to/cert.pem,/path/to/key.pem \
        --pkinit-anchor=/path/to/kdc-ca-bundle.pem
    ```
    
    Fixes: https://pagure.io/freeipa/issue/9271
    Fixes: https://pagure.io/freeipa/issue/9269
    Signed-off-by: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>