Add gssrpc to krb5-config

ticket: 7620
Add gssrpc to pkg-config

ticket: 7620
Disable the gssrpc expired-cred test

The "expired" test in expire.exp tries to authenticate to the server
process with an expired TGT (obtained using kinit -l -1m).  Using an
expired TGT to get an expired service cred no longer works after
#6948.  We could use kinit -S to get an expired service cred, but
krb5_get_credentials won't return expired service cred from the cache
(even before #6948).  We could use time offsets to simulate clock skew
between the client and server process, but that would be difficult
because the test programs don't have access to the krb5_context
objects used by the client or server process.  Since we don't have a
simple workaround, disable the test.
Disable UDP pass of gssrpc tests on all platforms

The AUTH_GSSAPI flavor of rpc authentication uses IP address channel
bindings.  These are broken over UDP, because svcudp_recv() fails to
get the destination address of incoming packets (it tries to use the
recvmsg() msg_name field to get the destination IP address, which
instead gets the source address; see ticket #5540).

There is no simple or comprehensive way to fix this; using IP_PKTINFO
is a fair amount of code and only works on some platforms.  It's also
not very important--nobody should be using AUTH_GSSAPI except perhaps
for compatibility with really old kadmin, and kadmin only runs over
TCP.  Since the gssrpc tests are closely wedded to AUTH_GSSAPI, the
simplest fix is to only run the TCP pass.
Don't use portmapper in RPC tests

On many Linux systems, due to what is arguably a bug in rpcbind, the
portmapper doesn't allow service registration from non-root processes.
This causes the RPC tests to be frequently skipped.  Modify the tests
so that they don't need the portmapper, by grabbing the port number
from the server process and passing it to the client.
Fix link line for t_fortuna

ticket: 7628
Add missing plugins.c to SRCS in util/support

Reported by Arlene Berry.

ticket: 7629
Fix mismatched spnego_mech.c declarations

The mechglue definitions of gssint_get_der_length and friends use
unsigned int for the buffer length, not OM_uint32.
Add kdcpreauth callback to check for client keys

Add a new have_client_keys callback to the kdcpreauth interface,
allowing modules to efficiently check whether the client DB entry has
any keys matching the request enctypes.

ticket: 7630
Check for keys in encrypted timestamp/challenge

Encrypted timestamp and encrypted challenge cannot succeed if the
client has no long-term key matching the request enctypes, so do not
offer them in that case.

ticket: 7630
Don't send empty etype info from KDC

RFC 4120 prohibits empty ETYPE-INFO2 sequences (though not ETYPE-INFO
sequences), and our client errors out if it sees an empty sequence of
either.

ticket: 7630
Make AS requests work with no client key

If we cannot find a client key while preparing an AS reply, give
preauth mechanisms a chance to replace the reply key before erroring
out.

ticket: 7630