Add constrained/unconstrained name attributes

The idea is that the, say, hostname of a hostbased service name ought to
be checked against the realm of the same to make sure that that realm is
allowed to issue tickets for that hostname as a client.  This applies
to: username, hostname, domainname.  If we had support for parsing the
PAC it'd apply to SIDs.  It's fundamental.  But many apps will want the
attribute values without such constraint checking.

XXX do change this so that constraint non-checking is denoted by an
attribute name prefix.