Use macro for IANA assigned PA-AS-CHECKSUM number

Replace numeric value '132' by the macro KRB5_PADATA_AS_CHECKSUM
in preauth plugin.
Add a few comments to `PADATA types` in krb5.hin

Mostly, based on
http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xml
Fix doc build

The addition of the KRB5_PADATA_AS_CHECKSUM macro in d7d74867952f caused
the doxygen bridge to emit a new RST file.  This file was not included in
the API reference toctree, causing a build failure in maintainer-mode.
Include default DIR::file ccache in collection

If the context's default ccache name is a subsidiary file of a
directory collection, include that single cache in the cursor walk
over the DIR type.

ticket: 7172
Add a script for [re]generating test PKI creds

[ghudson@mit.edu: reformatted to limit lines to 79 columns]
Add various client-authenticating PKINIT tests

Add tests for non-anonymous PKINIT:
* FILE: with no password
* FILE: with a password
* DIR: with no password
* DIR: with a password
* PKCS12: with no password
* PKCS12: with a password
* PKCS11: with a password, if soft-pkcs11.so is found via ctypes

[ghudson@mit.edu: reformatted to 79 columns; removed intermediate
success() calls]
Don't use expired TGTs in TGS-REQs

ticket: 6948
Better fix for not using expired TGTs in TGS-REQs

We want to generate a KRB5_AP_ERR_TKT_EXPIRED code when the TGT is
expired, like we would if we tried the TGT against the KCD.  To make
this work, separate the helpers for getting local and crossrealm
cached TGTs.  For a crossrealm TGT, match against the endtime, as
there could be multiple entries.  For a local TGT, find any match, but
check if it's expired.  The cache_code field is no longer needed after
this change, so get rid of it.

ticket: 6948
Add internal KDC_DIR macro

Define KDC_DIR in osconf.hin and use it for paths within the KDC
directory.
Add kdcpreauth callback to check for client keys

Add a new have_client_keys callback to the kdcpreauth interface,
allowing modules to efficiently check whether the client DB entry has
any keys matching the request enctypes.

ticket: 7625
Check for keys in encrypted timestamp/challenge

Encrypted timestamp and encrypted challenge cannot succeed if the
client has no long-term key matching the request enctypes, so do not
offer them in that case.

ticket: 7625
Don't send empty etype info from KDC

RFC 4120 prohibits empty ETYPE-INFO2 sequences (though not ETYPE-INFO
sequences), and our client errors out if it sees an empty sequence of
either.
add libkrad
add otp plugin