add support for FreeIPA backend - phase 1

This commit adds support for using FreeIPA as the DNS
backend.  This implementation uses the FreeIPA JSON
interface, doing HTTPS for security and Kerberos for
authentication.  The requirements are:
* python-kerberos 1.1 or later
* MIT kerberos5 version 1.11.3 or later
* A FreeIPA deployment, with an account that has access
to manage the DNS portion.  The admin@DOMAIN account
can be used for testing, but is not recommended for
production.  You must generate a keytab for this account
and Designate Central must have read access to
the keytab file.
* The CA cert file from FreeIPA (default /etc/ipa/ca.crt).

Specify backend_driver = ipa in the service:central config to
use the ipa backend.

The configuration parameters in the backend:ipa section are:
ipa_host - The hostname of the FreeIPA server (FQDN, for Kerberos)
ipa_port - default 443 - port number for web services listener
ipa_client_keytab - Kerberos client keytab file
ipa_ca_cert - HTTPS client CA certificate file
ipa_base_url - Base URL of web services server
             - default https://$ipa_host/ipa
ipa_json_url - IPA JSON RPC server
             - default $ipa_base_url/json
ipa_connect_retries - default 1 - the kerberos credentials will
expire periodically - the ipa backend will detect this and reauth
    - ipa will attempt to retry the auth this many times before giving
      up with an exception
ipa_force_ns_use - default False - IPA will attempt to resolve any
    server specified in an SOA mname or NS record - setting this parameter
    to True will force IPA to accept servers that cannot be resolved
ipa_version - version of IPA RPC - default 2.65
ipa_auth_driver_class - this is the domain + class name of the authentication
    driver (subclass of requests.auth.AuthBase) that the ipa backend will use
    to perform authentication against IPA
    - default designate.backend.impl_ipa.auth.IPAAuth
Implements: blueprint ipa-backend
Change-Id: I798ab4d7ff0df76e04825febe5ea33690050fa05
Merge "add support for FreeIPA backend - phase 1"