Fix never valid error condition in KDC

The TGS was incorrectly using authtime to compute renew_till for new
tickets, which was in turn leading to endtime potentially being equal to
starttime, which caused the TGS to return KRB5KDC_ERR_NEVER_VALID.

This happens when the TGT renewal lifetime is longer than the max renew
lifetime of any other services, after that much time (target services'
max renew life) passes.  The TGT is still good but TGS-REQs fail.
Also validate kdigest hacks

Add validation of the kdigest configuration parameters
Merge pull request #48 from pettai/master

Allow validation of kdigest stuff
kx509: Create certs for principals with slashes

kx509 fails to create certs for principals with slashes in them.  For
example:

    client% kinit foo/admin
    foo/admin@EXAMPLE.COM's Password:
    client% kx509
    Timed out waiting on KCA

The KCA reports: "Principal is not a user."  However, there is a use
case set out in this post:

https://thestaticvoid.com/post/2012/10/25/protecting-puppet-with-kerberos/

that would create a kx509 cert for a host principal for authenticating
against a secure HTTP service.  This commit modifies the certificate
creation code to allow principals with slashes in them.
Merge pull request #50 from MrStaticVoid/kx509-allow-slash-in-principal-name

kx509: Create certs for principals with slashes
Merge pull request #46 from jelmer/krb5-pc

Add heimdal-krb5.pc file, with krb5.pc depending on it.
spelling
use heimdal-krb5 instead of krb5 as dependency
kx509: Prevent double free

Patchset 750a09bca2183415be3ca3b8784e3417f484794b introduced the
potential for a double free of 'name'.

Change-Id: I23bd4ddb7d9b41cbb3948ab06245f4052b309971
add --policy documentation
Add heimdal-kadm-{client,server} with kadm-{client,server} depending on
them.