Allow user to specify the ipa server realm

We automatically determine the ipa realm. This allows the customer to override the default.

- this adds to the cli and appliance_console
- realm is also passed to ssl certificates
- better display of error messages

this change is needed by QE to test IPA integration. Probably most customers as well.

https://bugzilla.redhat.com/show_bug.cgi?id=1134540

/cc @abellotti @dajohnso