Allow multi-hop SAM-2 exchanges

Prior to 1.11, it was possible to do SAM-2 preauth exchanges with
multiple hops by sending repeated preauth-required errors with
different challenges (which is not the way multi-hop exchanges are
described in RFC 6113, but it can still work).  This stopped working
when SAM-2 was converted to a built-in module because of the use_count
field.  Disable the use count for SAM-2 specifically.

ticket: 7571
version_fixed: 1.11.1
status: resolved
Convert success in krb5_chpw_result_code_string

Result code 0 used to be converted properly by krb5_set_password,
though not krb5_change_password; this changed in 1.10 when
krb5int_setpw_result_code_string was folded into
krb5_chpw_result_code_string.  Restore the old behavior, and make it
apply to krb5_change_password as well, by making
krb5_chpw_result_code_string convert result code 0.

[ghudson@mit.edu: commit message]

(cherry picked from commit 316bf74b4696058e2b60c95c9d0fc90d6c2c2ffe)

ticket: 7569
version_fixed: 1.11.1
status: resolved