Add kerberos authentication support for nsupdate

Up until now snf-network used nsupdate with a keyfile to
dynamically update DNS entries on an external nameserver
(bind9). This patch adds support for authenticating against an
AD controller using Kerberos.

Specifically we use "k5start -H" to ensure there is a happy ticket,
otherwise use a keytab containing the password to obtain a ticket
automatically. Finally, we use nsupdate in GSS-TSIG mode (with -g option
and with KRB5CCNAME environment variable pointing to the ticket
obtained previously by k5start) to update AD-integrated DNS server.

The keytab file can be added with:

 # ktutil -v add -V 1 -e aes256-cts -p PRINCIPAL

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add doc section wrt kerberos authentication

..that explains how to configure snf-network in order to use
it for dynamic DNS update against an AD controller.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Some minor refactor in snf-network-dnshook

Let it run only after certain opcodes (instance-add, instance-modify,
instance-remove, instance-rename).

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Rewrite snf-network-dnshook

Mention correctly when it runs and be more informative wrt
nsupdate authentication methods supported (TSIG for bind9
and GSS-TSIG for AD).

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Use AUTHENTICATION_METHOD setting

The valid authentication methods are:

 - plain (nsupdate)
 - bind9 (nsupdate -k)
 - kerberos (nsupdate -g)

The plain method assumes that the server allows updates without
authentication (e.g. allow-update { 192.0.2.1;};). The bind9 method
uses the -k option and requires a keyfile. The kerberos method uses
the -g option and requires a principal and a keytab. For backwards
compatibility if AUTHENTICATION_METHOD setting is missing in
defaults file we use bind9.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update docs for AUTHENTICATION_METHOD

Mention AUTHENTICATION_METHOD setting in docs and update
configure section with all missing settings included in
/etc/default/snf-network.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>