Add check to double-check and/or test the constrained delegation configuration

[rcritten]

Constrained delegation failures can be difficult to diagnose. See if there is a way we can:

• exercise it in steps to validate that the pieces are working
• validate the configuration files

[rcritten]

Expanding on it a bit

• Start with https://www.freeipa.org/page/V4/Service_Constraint_Delegation.html and confirm that the IPA-created services are delegated properly
• Verify permissions/ownership files and directories in init/tmpfilesd/ipa.conf.in
• Validate /etc/systemd/system/httpd.service.d/ipa.conf
  against install/share/ipa-httpd.conf.template. We had a case where GSS_USE_PROXY was unset