Use macro for IANA assigned PA-AS-CHECKSUM number

Replace numeric value '132' by the macro KRB5_PADATA_AS_CHECKSUM
in preauth plugin.
Add a few comments to `PADATA types` in krb5.hin

Mostly, based on
http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xml
Fix doc build

The addition of the KRB5_PADATA_AS_CHECKSUM macro in d7d74867952f caused
the doxygen bridge to emit a new RST file.  This file was not included in
the API reference toctree, causing a build failure in maintainer-mode.
Include default DIR::file ccache in collection

If the context's default ccache name is a subsidiary file of a
directory collection, include that single cache in the cursor walk
over the DIR type.

ticket: 7172
Add a script for [re]generating test PKI creds

[ghudson@mit.edu: reformatted to limit lines to 79 columns]
Add various client-authenticating PKINIT tests

Add tests for non-anonymous PKINIT:
* FILE: with no password
* FILE: with a password
* DIR: with no password
* DIR: with a password
* PKCS12: with no password
* PKCS12: with a password
* PKCS11: with a password, if soft-pkcs11.so is found via ctypes

[ghudson@mit.edu: reformatted to 79 columns; removed intermediate
success() calls]
Don't use expired TGTs in TGS-REQs

ticket: 6948
Better fix for not using expired TGTs in TGS-REQs

We want to generate a KRB5_AP_ERR_TKT_EXPIRED code when the TGT is
expired, like we would if we tried the TGT against the KCD.  To make
this work, separate the helpers for getting local and crossrealm
cached TGTs.  For a crossrealm TGT, match against the endtime, as
there could be multiple entries.  For a local TGT, find any match, but
check if it's expired.  The cache_code field is no longer needed after
this change, so get rid of it.

ticket: 6948
Add internal KDC_DIR macro

Define KDC_DIR in osconf.hin and use it for paths within the KDC
directory.
Add gssrpc to krb5-config

ticket: 7620
Add gssrpc to pkg-config

ticket: 7620
Disable the gssrpc expired-cred test

The "expired" test in expire.exp tries to authenticate to the server
process with an expired TGT (obtained using kinit -l -1m).  Using an
expired TGT to get an expired service cred no longer works after
#6948.  We could use kinit -S to get an expired service cred, but
krb5_get_credentials won't return expired service cred from the cache
(even before #6948).  We could use time offsets to simulate clock skew
between the client and server process, but that would be difficult
because the test programs don't have access to the krb5_context
objects used by the client or server process.  Since we don't have a
simple workaround, disable the test.
Disable UDP pass of gssrpc tests on all platforms

The AUTH_GSSAPI flavor of rpc authentication uses IP address channel
bindings.  These are broken over UDP, because svcudp_recv() fails to
get the destination address of incoming packets (it tries to use the
recvmsg() msg_name field to get the destination IP address, which
instead gets the source address; see ticket #5540).

There is no simple or comprehensive way to fix this; using IP_PKTINFO
is a fair amount of code and only works on some platforms.  It's also
not very important--nobody should be using AUTH_GSSAPI except perhaps
for compatibility with really old kadmin, and kadmin only runs over
TCP.  Since the gssrpc tests are closely wedded to AUTH_GSSAPI, the
simplest fix is to only run the TCP pass.
Don't use portmapper in RPC tests

On many Linux systems, due to what is arguably a bug in rpcbind, the
portmapper doesn't allow service registration from non-root processes.
This causes the RPC tests to be frequently skipped.  Modify the tests
so that they don't need the portmapper, by grabbing the port number
from the server process and passing it to the client.
Fix link line for t_fortuna

ticket: 7628
Add missing plugins.c to SRCS in util/support

Reported by Arlene Berry.

ticket: 7629
Fix mismatched spnego_mech.c declarations

The mechglue definitions of gssint_get_der_length and friends use
unsigned int for the buffer length, not OM_uint32.
Add kdcpreauth callback to check for client keys

Add a new have_client_keys callback to the kdcpreauth interface,
allowing modules to efficiently check whether the client DB entry has
any keys matching the request enctypes.

ticket: 7630
Check for keys in encrypted timestamp/challenge

Encrypted timestamp and encrypted challenge cannot succeed if the
client has no long-term key matching the request enctypes, so do not
offer them in that case.

ticket: 7630
Don't send empty etype info from KDC

RFC 4120 prohibits empty ETYPE-INFO2 sequences (though not ETYPE-INFO
sequences), and our client errors out if it sees an empty sequence of
either.

ticket: 7630