Allow CustodiaClient to be used by arbitrary principals
    
    Currently CustodiaClient assumes that the client is the host
    principal, and it is hard-coded to read the host keytab and server
    keys.
    
    For the Lightweight CAs feature, Dogtag on CA replicas will use
    CustodiaClient to retrieve signing keys from the originating
    replica.  Because this process runs as 'pkiuser', the host keys
    cannot be used; instead, each Dogtag replica will have a service
    principal to use for Custodia authentication.
    
    Update CustodiaClient to require specifying the client keytab and
    Custodia keyfile to use, and change the client argument to be a full
    GSS service name (instead of hard-coding host service) to load from
    the keytab.  Update call sites accordingly.
    
    Also pass the given 'ldap_uri' argument through to IPAKEMKeys
    because without it, the client tries to use LDAPI, but may not have
    access.
    
    Part of: https://fedorahosted.org/freeipa/ticket/4559
    
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>