group: allow services as members of groups
    
    Allow services to be members of the groups, like users and other groups
    can already be.
    
    This is required for use cases where such services aren't associated
    with a particular host (and thus, the host object cannot be used to
    retrieve the keytabs) but represent purely client Kerberos principals to
    use in a dynamically generated environment such as Kubernetes.
    
    Fixes: https://pagure.io/freeipa/issue/7513
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>