Clustered keytab generation improvements

Fixes bug https://bugzilla.samba.org/show_bug.cgi?id=16267

This ended up touching a lot more CTDB things than I had planned.

The first main task was to update source3/script/winbind_ctdb_updatekeytab.sh so it only runs keytab updates on active nodes. This involved adding an active target to onnode. While trying to do this I found a bug in onnode that needed fixing. I also needed to update the onnode unit tests so the change would not cause test failures... and a new test could be written for the active target. This test suite had not been touched for a long time, so provided an opportunity for reformatting and ShellCheck improvements. Hence, 9 (or 8, see below) commits for what looked like a simple change.

Note that the commit ctdb-tools: Add "leader" target for onnode isn't actually used by the rest of the changes here. It was just easy to do. Although it currently carries a BUG: tag, I'm happy to drop it and not backport it if requested. That said, it seems a harmless and consistent addition.

The 2nd task was to fix the 46.update-keytabs event script so it didn't include a hardcoded path that is really aimed at testing. This was quite easy and involved adding a new CTDB_UPDATE_KEYTABS_SMB_CONF script option, plus a couple of unit tests for the event script. It was then time to extend source3/script/tests/test_update_keytab_clustered.sh to test that keytab generation behaved correctly for an inactive node and that a keytab was generated on a node when it made the transition from inactive to active.

Someone who cares about running utilities like net indirectly inside a testenv should review s3:lib: skip root check when running with uid-wrapper enabled to check that it is really what is desired. I think it is OK but if not then please suggest another way of allowing 46.update-keytabs to run the net command inside a testenv.

I spent a lot of time trying to make source3/script/tests/test_update_keytab_clustered.sh use source3/script/winbind_ctdb_updatekeytab.sh instead of source3/script/updatekeytab_test.sh, so the real code is tested. However, I couldn't figure this out so I cut my losses and gave up.

Checklist

• Commits have Signed-off-by: with name/author being identical to the commit author
• (optional) This MR is just one part towards a larger feature.
• (optional, if backport required) Bugzilla bug filed and BUG: tag added
• Test suite updated with functionality tests
• Test suite updated with negative tests
• Documentation updated
• CI timeout is 3h or higher (see Settings/CICD/General pipelines/ Timeout)

Reviewer's checklist:

• There is a test suite reasonably covering new functionality or modifications
• Function naming, parameters, return values, types, etc., are consistent and according to README.Coding.md
• This feature/change has adequate documentation added
• No obvious mistakes in the code