Separate clpreauth and kdcpreauth interfaces

Since there is no overlap between the clpreauth and kdcpreauth
interface declarations, there's no particular reason to combine them
into one header.  For backward compatibility and convenience, leave
behind a preauth_plugin.h which includes both.
Use a proper consumer interface for clpreauth

In preauth2.c, use wrapper functions for calls to clpreauth functions.
Get rid of the expanded-out module table, instead using a helper
function to find the handle for a preauth type.  Replace use counts
with a list of previously processed pa types.  Check for pa type
conflicts when loading clpreauth modules.
Make clpreauth flags function optional

With one exception (KRB5_PADATA_PKINIT_KX), every padata type
processed by a clpreauth module is now a real preauthentication type.
Reduce the amount of boilerplate required for a clpreauth module by
making the flags method optional if all of the preauth types
advertised by the module are real.
Rename internal preauth functions

The preauth functions are internal to libkrb5, so use the k5_ prefix,
don't use KRB5_CALLCONV, and prototype them in int-proto.h.  Also
remove krb5_do_preauth from the Unix libkrb5 export list.

Reorder the k5_preauth() and k5_preauth_tryagain() arguments for more
consistency with the clpreauth interface, and put the output padata
arguments at the end.

Rename any remaining uses of "kcontext" to "context" in preauth2.c.
Pass through module errors when preauthenticating

If we are responding to a KDC_ERR_PREAUTH_REQUIRED and cannot
preauthenticate, report the error from the first real preauth type we
tried.

k5_preauth() now accepts a boolean input indicating that it must
succeed on a real preauth type, instead of returning a boolean saying
whether or not it did.

ticket: 7517 (new)
Don't output trailing whitespace in depfix.pl

All of our deps files have a trailing space in the first line,
originating from depfix.pl.  This space triggers the whitespace
checker when generating a new deps file.  Get rid of the trailing
whitespace in the script; the change will be reflected in the deps
files the next time they are regenerated.
Remove unused functions in the LDAP KDB module
Remove unneeded code in krb5_ldap_put_principal

krb5_ldap_put_principal contained some conditionals for the case where
entry->princ is NULL, but only after entry->princ was dereferenced
unconditionally.  It's not necessary to handle this case, so don't.
Simplify LDAP KDB module container DN handling

Outside of krb5_ldap_read_krbcontainer_params and
krb5_ldap_create_krbcontainer, no fields of
krb5_ldap_krbcontainer_params were used except for the DN.  There was
code to create a krbTicketPolicyReference attribute (which would fail
because the schema doesn't allow that attribute, and was never
exercised because kdb5_ldap_util would never set the parameter) and to
read fields like max ticket life from the referenced ticket policy,
but those fields were never used.

Eliminate the structure and just store the container DN in
krb5_ldap_context.  Continue creating the container object when
creating a realm (by calling krb5_ldap_create_krbcontainer
unconditionally; it now exits successfully if the container already
exists), but don't ever read it.
Remove LDAP realm krbTicketPolicyReference code

ldap_realm.c had some code intended to handle a
krbTicketPolicyReference from a krbRealmContainer object, but there
wasn't enough of it to ever do anything.  Remove it.
Generate dependencies for kdb5_ldap_util
Get rid of KRB5_KDB_SRV_TYPE_PASSWD

Nothing was using KRB5_KDB_SRV_TYPE_PASSWD, so get rid of it.
(kpasswdd is part of kadmind and interacts with the KDB using
KRB5_KDB_SRV_TYPE_ADMIN.)
Simplify k5test.py environments

The initial k5test.py design, copied from the dejagnu suite, is to
create config files and environments for four expected roles: client,
server, master, and slave.  This approach exaggerates the complexity
of the common case, where the configurations don't need to vary, and
limits us to having just one slave for kprop/iprop tests.

Instead, create just one configuration by default, and add a
special_env() method which sets up a differently configured
environment for the few test cases which need one.  The run_as_*()
methods are collapsed into just run(), which accepts an optional
argument for the environment returned by special_env().
Fix clntraw_create initialization

clntraw_create has been broken since inception; on the first call, it
would compute invalid values of xdrs and client and dereference them.
Fix that.  (This is pretty strong evidence that no one has ever used
it.)  Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>.

ticket: 7511
Avoid null dereference in BDB dbtree error case

An error case in __bt_first would deference a null pointer.  This is
an old upstream BDB bug.  Use a separate variable to hold the result
of mpool_get() until it has been checked.  Reported by Nickolai
Zeldovich <nickolai@csail.mit.edu>.

ticket: 7511
Remove inoperative null checks in KDC code

In prepare_error_tgs, kdc_free_rstate, and kdc_fast_handle_error,
remove unnecessary null checks.  The callers avoid passing null
states, and in each case we've already dereferenced the pointer
earlier.  Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>.

ticket: 7511
Fix signed overflow check in k5_ucs2s_to_utf8s

Signed overflow must be checked before it happens, since modern
versions of gcc will optimize out checks of the result.  Reported by
Nickolai Zeldovich <nickolai@csail.mit.edu>.

ticket: 7511
Fix uninit variable in preauth2.c

The previous change for this ticket caused a situation where ret could
be returned without being initialized.

ticket: 7517