Don't fail init due to EACCES on krb5.conf

When DNS service discovery is enabled, we tolerate missing krb5.conf
files gracefully, but only when they don't exist (i.e.,
profile_init_flags returns ENOENT). If one of the possible
configuration files or a parent directory is inaccessible due to
insufficient permissions, however, we fail library initialization.
This patch gracefully falls back on DNS discovery in the EACCES and
EPERM case.