Fix an error case in krb5_sendauth

If we fail to get the client principal when constructing the
stack-allocated creds structure, don't double-free creds.server.
Fix an error case in krb5int_fcc_new_unique

If we fail to allocate setptr, don't close ret, since we've already
done so.
Fix unused assignment in mechglue loadConfigFile
Init output parameter of krb5_decode_princ_entry

For easier static analysis, make sure that krb5_decode_princ_entry
always sets *entry_ptr to a valid entry or NULL.
Fix krb5_ldap_put_password_policy cleanup

Initialize policy_dn since we clean it up.  Also free it
unconditionally.
Get rid of krb5_xfree
Fix more password_policy cleanup code

Initialize policy_dn in krb5_ldap_create_password_policy; free values
unconditionally in all ldap_pwd_policy.c cleanup handlers.
Fix kdb_ldap_create_principal cleanup

entry must be initialized before all code which can jump to cleanup.
Clean up cksum handling in CMAC token functions

In krb5int_dk_cmac_encrypt, cksum wasn't used.  In
krb5int_dk_cmac_decrypt, cksum needs to be initialized since we clean
it up.
Using k5-int.h data helpers for some functions

Use empty_data(), alloc_data(), and make_data() in some appropriate
places.  This has the side effect of initializing the krb5_data magic
field, which can placate debugging tools.
Simplify krb5_ldap_readpassword

There's no need to check whether the file exists and is readable
before opening it, and setting an extended error message which is just
strerror_r() of the errno value isn't useful.
Fix errno hygiene in kadmind write_pid_file

fclose() might overwrite the errno value from fprintf, causing us to
return success when we shouldn't.  Record the errno value at the time
of the fprintf failure.
Fix typo in ktest_make_sample_auth_pack
Fix zap size in confounder checksum mk_xorkey
Free unconditionally in plugins.c

Get rid of unnecessary null checks before freeing values in
libkrb5support's plugin code.
Reformat tests/gss-threads
Fix warnings in tests/gss-threads
Fix copy/pasto in ksu error message

Obtained from Debian.
Add support for client keytab from cred store

The new credential store extensions added support for specifying a
specific ccache name and also a specific keytab to be used for accepting
security contexts, but did not add a way to specify a client keytab
to be used in conjunction with the Keytab initiation support added also
in 1.11

This patch introduces a new URN named client_keytab through which a
specific client_keytab can be set when calling gss_acquire_cred_from()
and Keytab Initiation will use that keytab to initialize credentials.

[ghudson@mit.edu: minor C style fix]

ticket: 7598 (new)
Add gss_import_cred_from client keytab test

Modify t_credstore.c to be more flexible and adjust t_gssapi.py
accordingly.  Add a test to t_client_keytab.py which acquire creds
using a programmatically specified client keytab.

ticket: 7598