Allow user to specify the ipa server realm

We automatically determine the ipa realm. This allows the customer to override the default.

- this adds to the cli and appliance_console
- realm is also passed to ssl certificates
- better display of error messages

outstanding: add bugzilla link

/cc @abellotti @dajohnso 
Let's move the Failed message to be the last thing before we return false in that rescue block:

  say e.result.output
  say e.result.error
  say ""
  say ("Failed to Configure External Authentication - #{e}")
  return false