Move cross-realm info to the cross-realm section

It's really not appropriate for the "examples" subsection of
"Adding, modifying and deleting principals".

While here, update the enctype recommendation for cross-realm principals
to something that does not include weak crypto.
Remove pronoun referent ambiguity

The policy must be unused, not the delete_policy command.
Wordsmith kdb5_util stash -f

The keyfile worth overriding is the one in kdc.conf. Though using
stash -f would override kdb5_util's -sf argument, there is no reason to
pass both flags to the same invocation.
In any case, the "at startup" language is not really correct.
Update kdb5_util example output

This text has not caught up with changes to the utility itself.
As a side effect, our output text box is narrower and does not have
to scroll on as many browser windows.
Fix copy/paste errors in dbadmin

We should include the stashsrvpw content in that section, not
the list content.  Likewise, the list_policy content instead
of the destroy_policy content.
Fix ordered list style

Sphynx outputs class information that corresponds to its generated
basic.css, which we do not include.  This results in all lists,
even nested lists, using arabic numerals.
Import the class properties into kerb.css for now.
Improve the ktadd and ktremove synopses

Mention the options on the synopsis line, and do not imply that
the principal argument(s) for ktadd are optional.
reST line blocks are needed to keep the two forms of ktadd on
separate lines.
Fix cast regexp in C style checker

In check_cast, we want to match cast operators with or without spaces
after the closing paren, and then check for spaces after we match.
Also, per the comment, we want to match potential cast operators
followed by an open paren.
Fix a couple of typos
Add an input ccache get-init-creds option

Add a krb5_get_init_creds_opt_set_in_ccache() function.  An input
ccache may hold configuration data which the client libraries can
use to influence their decisions.
Use octal escapes for non-printable parts of {str}/{lenstr}/{data}

When adding {str}, {lenstr}, or {data} to trace output, scan for
bytes which might be non-printable, and add them as octal-escaped
versions of themselves if any are found.
Add a -C flag to dump configuration entries
Add "pa_types" configuration to ccaches

* When producing preauth data, keep track of the types of padata which
  the module that produced the data can handle.  Originally this was
  just the type of data we'd produced, but that caused problems for
  PKINIT.
* After obtaining credentials, store that list of preauth types as a
  "pa_types" configuration item in the out_ccache.
* Read a list of allowed preauth types from an in_ccache, if possible.
* If we have a list of allowed preauth types, skip any "real" modules
  which aren't in that list.
Test in_ccache and pa_types functionality

* Add a krb5int_build_conf_principals() function to allow our get/set
  code to directly prune out duplicate config entries.
* Verify that when we specify pa_types, they affect whether or not we
  will use a particular preauth mechanism.
* Verify that we correctly save the list of preauth mechanisms that are
  used in out_ccaches.
Add "pa_config_data" configuration to ccaches

* Read a "pa_config_data" item from an in_ccache, if provided, and add a
  callback which client preauth plugins can use to retrieve a string
  value that's keyed by a string.
* Add a callback which client preauth plugins can use to provide string
  key/value pairs to be stored in the ccache.
Use config storage for client identity selection

* Keep track of the names of client identities when we load them.
* Store the client identity we just used when we create or retry a
  client request.
* If we read a client identity from the configuration, treat it like the
  KDC does: pick the "this is it, there is no other" logic branch.
Use config storage for client OTP token selection

* Save the vendor name of the token we used to create the challenge.
* If we saved the name of a token vendor previously, prune out any
  tokeninfos which contain different vendor names.
Reset the prompt_types list after calling prompters

Reset the prompt_types list immediately after the prompter callback
returns, as is done everywhere else.
Sanity-check loading keys and certs from PEM files

Print a debug message if we're unable to locate the matching private key
for a certificate when we've just loaded both of them from PEM files.
Agility fix: don't try to free an uninitialized keyblock.