Remove CA cert on client uninstall

The CA cert (/etc/ipa/ca.crt) was not being removed
on client uninstall, causing failure on subsequent client
installation in some cases.

https://fedorahosted.org/freeipa/ticket/3537
Add ipakrbokasdelegate option to service and host Web UI pages

https://fedorahosted.org/freeipa/ticket/3329
spec: detect Kerberos DAL driver ABI change from installed krb5-devel

Find out Kerberos middle version to infer ABI changes in DAL driver.

We cannot load DAL driver into KDC with wrong ABI. This is also needed to
support ipa-devel repository where krb5 1.11 is available for Fedora 18.