kerberos: Discover and validate realm before use

GoaKerberosProvider now talks directly with realmd
to get its list of available realms.

Since it talks to realmd directly it now has
an opportunity to validate what the user is typing,
and e.g. map domains the user types into realms.

This commit adds that additional discovery logic,
rather than passing what the user types blindly
to the identity service.

https://bugzilla.gnome.org/show_bug.cgi?id=686416