Add DNS over TLS support

Add DNS over TLS support using Unbound as a local resolver. This
includes new options on both server and client side.

* `--dns-over-tls`: enable DNS over TLS support. This option is present
  on both client and server. It deploys Unbound and configures BIND on
the server to receive DoT requests.
* `--dot-forwarder`: the upstream DNS server with DoT support. It must
  be specified in the format `1.2.3.4#dns.server.test`
* `--dns-over-tls-key` and `--dns-over-tls-cert`: in case user prefers
  to have the DoT certificate in BIND generated by themselves. If these
  are empty, IPA CA is used instead to request a new certificate.

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Varun Mylaraiah <mvarun@redhat.com>
Reviewed-By: Pavel Brezina <pbrezina@redhat.com>

ipapython/ipautil.py

@@ -266,6 +266,19 @@ class CheckedIPAddressLoopback(CheckedIPAddress):
                   file=sys.stderr)
 
 
+class IPAddressDoTForwarder(str):
+    """IPv4 or IPv6 address with added hostname as needed for DNS over TLS
+    configuration. Example: 1.2.3.4#dns.hostname.test
+    """
+    def __init__(self, addr):
+        addr_split = addr.split("#")
+        if len(addr_split) != 2 or not valid_ip(addr_split[0]):
+            raise ValueError(
+                "DoT forwarder must be in the format "
+                "of '1.2.3.4#dns.example.test'."
+            )
+
+
 def valid_ip(addr):
     return netaddr.valid_ipv4(addr) or netaddr.valid_ipv6(addr)