Use an in-memory cache until we need the target's

Instead of copying source or obtained creds into the target cache and
changing ownership if everything succeeds, copy them into a MEMORY:
cache and then, if everything succeeds, create the target cache as the
target user.
Learn to destroy the ccache we're copying from

Add a flag to krb5_ccache_copy() which will instruct it to destroy a
source ccache after reading its contents.  Using this when we copy the
creds from a MEMORY cache to somewhere else is necessary to avoid having
a subsequent call to krb5_cc_cache_match() select the MEMORY cache when
we're trying to have it search a different location by default.
Try to use the default_ccache_name'd as the target

Try to use the location named by the default_ccache_name setting as the
target cache.  If it's a collection, just create or update a subsidiary
cache.  If it's not, then fall back to creating a new cache to try to
avoid destroying the contents of one that might already be there.  We
can't really detect this in advance for KEYRING: caches, though.
Be more careful of target ccache collections

When copying credentials to a cache collection, take care to avoid
generating multiple caches for a single client principal, but don't
change the primary out from anyone who might already be using the
target collection.
Copy config entries to the target ccache

When we try to screen out expired creds while reading them from one
ccache to eventually store in another, also keep configuration entries.