Add control over session key enctype negotiation

Adds a principal string attribute named "session_enctypes" which can
specify what enctypes the principal supports for session keys.  (For
what it's worth, this actually allows one to list des-cbc-md5 as a
supported session key enctype, though obviously this hardly matters
now.)

Add a [realms] section parameter for specifying whether to assume that
principals (which lack the session_enctypes attribute) support
des-cbc-crc for session keys.  This allows those who still need to use
allow_weak_crypto=true, for whatever reason, to start reducing the
number of tickets issued with des-cbc-crc session keys to clients
which still give des-cbc-crc preference in their default_tgs_enctypes
list.

[ghudson@mit.edu: Miscellaneous edits, cleanups, and fixes; refactored
test script; documented session_enctypes attribute]
Try to make t_trace.c output consistent

Attempt to choose tracing inputs in t_trace.c which will produce
consistent output across platforms and logins.  Re-enable the
comparison against the reference file.
Don't free caller's principal in vfy_increds

#7125 took out the copy of the krb5_verify_init_creds server argument
but left in the corresponding free, so it was freeing a caller-owned
principal.  Reported by Russ Allbery.

ticket: 7162
Remove krb5_is_permitted_enctype_ext

It's an internal function (not in krb5.h or the libkrb5 export list)
and nothing uses it.
Rename and add to etype utility functions

Rename krb5int_count_etypes and krb5int_copy_etypes to have k5_
prefixes, and make them available outside of libkrb5 (but not part of
the public API).  Add k5_etypes_contains to search an etype list, and
use it in krb5_is_permitted_enctype.
Fix memory leak in dbentry_supports_enctype in KDC

The etypes list was never freed.  Also use k5_etypes_contains.
Update Build Kerberos V5 doc section

ticket: 7126
Remove big-endian gss-krb5 support

The big_endian flag in krb5_gss_ctx_id_rec is there for
interoperability with a really ancient implementation which we believe
is no longer in use.  Get rid of it and the code to handle it.

ticket: 7166 (new)
Clean up default_an_to_ln and fix a minor leak

The default realm could be leaked if the principal had the wrong
number of components.  Reported by Russ Allbery.

ticket: 7161
Remove krb5int_cc_os_default_name

krb5int_cc_os_default_name has been unused since #6955 removed the
call to it in cccursor.c.  Get rid of it.
Document allowed time formats for kinit and ksu
Fix spelling of "start_time" in previous
Add krb5_cccol_have_content API

Add a new API to determine whether any krb5 credentials are available
in the ccache collection.  Add tests to t_cccol.py.

ticket: 7173 (new)
Fail from gss_acquire_cred if we have no creds

If a caller tries to acquire krb5 initiator creds with no desired name
and we have no credentials in the cache collection, fail from
gss_acquire_cred intead of deferring until gss_init_sec_context.

ticket: 7160
Document version for new API functions
Remove CRs from options2configure.rst

options2configure.rst had CRLF newlines, and should have LF newlines
like everything else.
Minor reformating for better Sphinx HTML output

No content was changed.
Document how to free krb5_cc_get_full_name result

Also, in klist, use the appropriate libkrb5 free functions for
krb5_cc_get_full_name and krb5_unparse_name_results.  Reported by
Kevin Wasserman.

ticket: 7179
Remove orphaned KfM code
Simplify bld_princ.c