Add generic and krb5-specific name attributes

Status: builds.  No tests written yet.

The idea is to have some generic and some krb5-specific name attributes
now, adding more later.

Generic attributes:

 - issuer name (generic term for Kerberos' "realm name")
 - username
 - service name
 - hostname
 - domainname

We already had a local attribute, "local-login-user", for aname2lname;
that's now implemented.

There's also a name attribute intended to be used as a prefix of others:

 - GSS_C_ATTR_GENERIC_UNCONSTRAINED

   This attribute asks that the value of the attribute following it be
   returned without checking any naming constraints for the issuer.

   In other words, normally to ask for the hostname of a NAME will
   return the hostname only if the name is host-based *and* if the
   NAME's issuer is permitted to issue credentials for the given
   hostname.  If one wishes to get the hostname with no such constraints
   checking then one should ask for
   GSS_C_ATTR_GENERIC_UNCONSTRAINED + " " + GSS_C_ATTR_GENERIC_HOSTNAME.

   For hostnames the constraint checked should be that the realm matches
   the hostname's domain or that the hostname's realm per-domain_realm
   matches the name's realm.  Ditto domainnames.

   For usernames we check that the username be of the form
   name@tolower(realm) or else that the realm be the default realm (that
   should be user_realm).

The default is that name attributes' values are constrained.

Kerberos-specific attributes:

 - realm
 - name-type
 - components (iterate over all of them)
 - component 0
 - component 1
 - ..
 - component 9

The Kerberos-specific attributes so far are all unconstrained, since
principal name components have no meaning without reference to a name
type, and for defined name types we have generic attributes that suffice
and which are constrained by default.
Add test program for name attributes

There's no script to drive the test program, but manual testing with the
krb5.conf in tests/gss works.  And there are no new leaks or memory
errors (i.e., it's been through valgrind).