Provide API for management of host, service, and user principal aliases
    
    New commands (*-{add,remove}-principal [PKEY] [PRINCIPAL ...])
    were added to manage principal aliases.
    
    'add' commands will check the following:
    * the correct principal type is supplied as an alias
    * the principals have correct realm and the realm/alternative suffix (e.g.
      e-mail) do not overlap with those of trusted AD domains
    
    If the entry does not have canonical principal name, the first returned
    principal name will be set as one. This is mostly to smoothly operate on
    entries created on older servers.
    
    'remove' commands will check that there is at least one principal alias equal
    to the canonical name left on the entry.
    
    See also: http://www.freeipa.org/page/V4/Kerberos_principal_aliases
    
    https://fedorahosted.org/freeipa/ticket/1365
    https://fedorahosted.org/freeipa/ticket/3961
    https://fedorahosted.org/freeipa/ticket/5413
    
    Reviewed-By: David Kupka <dkupka@redhat.com>
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>