Search/replace to catch up with 6dda2845
Add a krb5_db_check_pkinit_binding() to libkdb

Provide a way for kdb modules to decide whether or not a given client
certificate corresponds to a particular client principal.
Use krb5_db_check_pkinit_binding() in the KDC

Use krb5_db_check_pkinit_binding() to check if the supplied certificate
matches the client in question.  If the kdb method doesn't return TRUE,
fall back to the SAN checking it's always done.  This doesn't alter any
other requirements we have for client certificates.
Provide a check_pkinit_binding() method

Provide a check_pkinit_binding() function which checks the client's
directory server entry for a userCertificate value that's byte-for-byte
the same as the one we've been given to compare to.