Remove allow_constrained_delegation from gssproxy.conf
    
    The Apache process must not allowed to use constrained delegation to
    contact services because it is already allowed to impersonate
    users to itself. Allowing it to perform constrained delegation would
    let it impersonate any user against the LDAP service without authentication.
    
    https://pagure.io/freeipa/issue/6225
    
    Reviewed-By: Simo Sorce <ssorce@redhat.com>