Allow the realm to be included in the name passed to add_service_principal()

This is more kerberos-like and it doesn't hurt anything, we just won't
allow realms other than our own to be used.

437566

ipa-python/ipaerror.py

@@ -158,6 +158,11 @@ INPUT_MALFORMED_SERVICE_PRINCIPAL = gen_error_code(
         0x0005,
         "The requested service principal is not of the form: service/fully-qualified host name")
 
+INPUT_REALM_MISMATCH = gen_error_code(
+        INPUT_CATEGORY,
+        0x0006,
+        "The realm for the principal does not match the realm for this IPA server.")
+
 #
 # Connection errors
 #