Enforce minimum PBKDF2 iteration count

Also add a testing interface to allow weak iteration counts.
(Published test vectors use weak iteration counts.)

(cherry picked from commit 7a7736a3ea321aeb4b281ae2712e27becb00d720)

ticket: 7465
version_fixed: 1.12
status: resolved
Set expiration time on keys and keyrings

By setting the timeout based on the credetial's timeout we let the
system automatically cleanup expired credentials.

[ghudson@mit.edu: simplified code slightly]

(cherry picked from commit 29e60c5b7ac0980606971afc6fd6028bcf0c7f0f)

ticket: 7769
version_fixed: 1.12
status: resolved
Add support to store time offsets in cc_keyring

The code follows the same model used for the memory ccache type.  Time
offsets are stored in each credential cache in a special key just like
the principal name.  Legacy session caches do not store timestamps as
legacy code would fail when iterating over the new offset key.

[ghudson@mit.edu: minor formatting changes; note legacy session
exception in commit message]

(cherry picked from commit fb4817a32d0c369049e0868468dd2eb75487630d)

ticket: 7768
version_fixed: 1.12
status: resolved
Remove dangling --with-kdc-kdb-update references

This configure option hasn't done anything since 1.8, so don't mention
it in configure --help or the documentation.  The disable_last_success
and disable_lockout DB options are now used to turn it off.

(cherry picked from commit 0b3225d63f50d4e6297be5d751cae1d3368fcdb1)

ticket: 7771 (new)
version_fixed: 1.12
status: resolved
Clarify lockout replication issues in docs

In the "KDC replication and account lockout" section of lockout.rst,
specifically call out kprop and incremental propagation as the
mechanisms which do not replicate account lockout state, and add a
note that KDCs using LDAP may not be affected by that section's
concerns.

(cherry picked from commit 8eb9e6fe1b01faa875dcf91b618ad4cd7793438a)

ticket: 7773
version_fixed: 1.12
status: resolved