ipa-kdb: use entry DN to compare aliased entries in S4U operations
    
    When working with aliased entries, we need a reliable way to detect
    whether two principals reference the same database entry. This is
    important in S4U checks.
    
    Ideally, we should be using SIDs for these checks as S4U requires PAC
    record presence which cannot be issued without a SID associated with an
    entry. This is true for user principals and a number of host/service
    principals associated with Samba. Other service principals do not have
    SIDs because we do not allocate POSIX IDs to them in FreeIPA. When PAC
    is issued for these principals, they get SID of a domain computer or
    domain controller depending on their placement (IPA client or IPA
    server).
    
    Since 389-ds always returns unique entry DN for the same entry, rely on
    this value instead. We could have used ipaUniqueID but for Kerberos
    principals created through the KDB (kadmin/kdb5_util) we don't have
    ipaUniqueID in the entry.
    
    Fixes: https://pagure.io/freeipa/issue/9031
    
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>