Add internal path expansion functions

Add an adapted version of Heimdal's expand_path.c, defining
k5_expand_path_tokens() and k5_expand_path_tokens_extra().  These
functions allow template paths like %{TEMP}/krb5cc_%{uid} to be
resolved.  Also add a test program to exercise the path expansion
code.
Add token expansion for keytab names

Make the default_keytab_name and default_client_keytab_name variables
subject to parameter expansion.

ticket: 7219 (new)
Rearrange ccdefname.c slightly

Eliminate the USE_CCAPI variant of get_from_os() which was only used
in KfM.  Make get_from_os() allocate its result (wrapping the Windows
implementation so it can continue to use a fixed-size buffer).
Simplify krb5_cc_set_default_name() and krb5_cc_default_name().  Make
some minor style adjustments.
Rename tests/t_cccol.py to t_ccache.py

Generalize the ccache collection tests in t_cccol.py to multiple kinds
of ccache tests, and rename it to avoid confusion with the lower-level
lib/krb5/ccache/t_cccol.py.  Move a test from t_general.py into
t_ccache.py.
Add default_ccache_name profile variable

Like default_keytab_name and default_client_keytab_name,
default_ccache_name is subject to parameter expansion.

ticket: 7220 (new)
Support changing the built-in ccache/keytab names

* Add DEFCCNAME, DEFKTNAME, and DEFCKTNAME configure variables to
  change the built-in ccache and keytab names.
* Add krb5-config options to display the built-in ccache and keytab
  names.
* In the default build, use krb5-config to discover the system's
  built-in ccache and keytab names and use them (if not overridden).
  This can be controlled with the --with-krb5-config=PATH or
  --without-krb5-config configure options.
* Make the built-in ccache name subject to parameter expansion.

ticket: 7221 (new)
Minor fixes to expand_path.c

Corrections to stuff noticed by kaduk:
* Eliminate a space before paren in a call to free().
* Use %lu for unsigned long in format strings.
* Simplify the tokens table definition.
turn off the replay cache in krb5_verify_init_creds()

The library isn't attempting a replay attack on itself, so any detected
replays are only going to be false-positives.
add an input ccache get-init-creds option
add "pa_types" configuration to ccaches

* When producing preauth data, keep track of the types of padata which
  the module that produced the data can handle.  Originally this was
  just the type of data we'd produced, but that caused problems for
  PKINIT.
* After obtaining credentials, store that list of preauth types as a
  "pa_types" configuration item in the out_ccache.
* Read a list of allowed preauth types from an in_ccache, if possible.
* If we have a list of allowed preauth types, skip any "real" modules
  which aren't in that list.
add a variation on the cc_set_config trace message

Add a variation on the cc_set_config trace message which prints the data
in hex-encoded form, and use it when we trace cc_set_config, if there
are any unprintable characters in the data.
add a -C flag to dump configuration entries
add "pa_config_data" configuration to ccaches

* Read a "pa_config_data" item from an in_ccache, if provided, and add a
  callback which client preauth plugins can use to retrieve a data item
  that's indexed and stored as a preauth data item (krb5_pa_data *).
* Add a callback which client preauth plugins can use to provide a data
  item, formatted as a preauth data item (krb5_data + preauth type), and
  store them in the out_ccache, if possible.
fix a typo
use config storage for client identity selection

* Keep track of the names of client identities when we load them.
* Store the client identity we just used when we create or retry a
  client request.
* If we read a client identity from the configuration, treat it like the
  KDC does: pick the "this is it, there is no other" branch.
anonymity fixes