Add hint message about --force-join option when enrollment fails

When client enrollment fails due to the fact that host entry
already exists on the server, display an message informing the
user about the possibility of using --force-join option.

https://fedorahosted.org/freeipa/ticket/3572
Avoid removing sss from nssswitch.conf during client uninstall

This patch makes sure that sss is not removed from nsswitch.conf
which causes probles with later uses of sssd. Makes sure that
authconfig with --disablesssd option is not executed during
ipa client uninstall.

https://fedorahosted.org/freeipa/ticket/3577
Add DNS records for existing masters when installing DNS for the first time.

https://fedorahosted.org/freeipa/ticket/3564
Add ipa-ca records for existing CA masters when installing DNS for the first time.

https://fedorahosted.org/freeipa/ticket/3564
Handle socket.gethostbyaddr() exceptions when verifying hostnames.

Log any socket exceptions raised and let the process continue. This
failure isn't a show-stopper. Other checks past this will catch any
other problems.

This was seen when /etc/hosts and /etc/resolv.conf were both empty.

https://fedorahosted.org/freeipa/ticket/3581
Do not display an interactive mode message in unattended mode

https://fedorahosted.org/freeipa/ticket/3576
Add missing permissions to Host Administrators privilege

The 'Host Administrators' privilege was missing two permissions
('Retrieve Certificates from the CA' and 'Revoke Certificate'), causing
the inability to remove a host with a certificate.

https://fedorahosted.org/freeipa/ticket/3585