Remove krb5_is_permitted_enctype_ext

It's an internal function (not in krb5.h or the libkrb5 export list)
and nothing uses it.
Rename and add to etype utility functions

Rename krb5int_count_etypes and krb5int_copy_etypes to have k5_
prefixes, and make them available outside of libkrb5 (but not part of
the public API).  Add k5_etypes_contains to search an etype list, and
use it in krb5_is_permitted_enctype.
Fix memory leak in dbentry_supports_enctype in KDC

The etypes list was never freed.  Also use k5_etypes_contains.
Update Build Kerberos V5 doc section

ticket: 7126
Remove big-endian gss-krb5 support

The big_endian flag in krb5_gss_ctx_id_rec is there for
interoperability with a really ancient implementation which we believe
is no longer in use.  Get rid of it and the code to handle it.

ticket: 7166 (new)
Clean up default_an_to_ln and fix a minor leak

The default realm could be leaked if the principal had the wrong
number of components.  Reported by Russ Allbery.

ticket: 7161
Remove krb5int_cc_os_default_name

krb5int_cc_os_default_name has been unused since #6955 removed the
call to it in cccursor.c.  Get rid of it.
Document allowed time formats for kinit and ksu
Fix spelling of "start_time" in previous
Add krb5_cccol_have_content API

Add a new API to determine whether any krb5 credentials are available
in the ccache collection.  Add tests to t_cccol.py.

ticket: 7173 (new)
Fail from gss_acquire_cred if we have no creds

If a caller tries to acquire krb5 initiator creds with no desired name
and we have no credentials in the cache collection, fail from
gss_acquire_cred intead of deferring until gss_init_sec_context.

ticket: 7160
Document version for new API functions
Remove CRs from options2configure.rst

options2configure.rst had CRLF newlines, and should have LF newlines
like everything else.
Minor reformating for better Sphinx HTML output

No content was changed.
Document how to free krb5_cc_get_full_name result

Also, in klist, use the appropriate libkrb5 free functions for
krb5_cc_get_full_name and krb5_unparse_name_results.  Reported by
Kevin Wasserman.

ticket: 7179
Remove orphaned KfM code
Simplify bld_princ.c
Handle PKINIT DH replies with no certs

If a PKINIT Diffie-Hellman reply contains no certificates in the
SignedData object, that may be because the signer certificate was a
trust anchor as transmitted to the KDC.  Heimdal's KDC, for instance,
filters client trust anchors out of the returned set of certificates.
Match against idctx->trustedCAs and idctx->intermediateCAs to handle
this case.  This fix only works with OpenSSL 1.0 or later; when built
against OpenSSL 0.9.x, the client will still require a cert in the
reply.

Code changes suggested by nalin@redhat.com.

ticket: 7183
Flatten KDC lookaside cache entries

Use krb5_data structures instead of pointers in the entry structure,
reducing the number of memory allocations.
Limit size of lookaside cache

Add a preprocessor constant LOOKASIDE_MAX_SIZE (defaulting to 10MB)
which limits the total size of the lookaside cache entries.  Purge
stale entries in kdc_insert_lookaside instead of kdc_check_lookaside,
and when doing so, continue purging non-stale entries until the total
cache size (including the new entry) is within the size constraint.