goaidentity: fall back to polling when monitoring is unavailable

We don't support getting change notification for all kerberos credential
cache types.  Rather than fail, in these cases, fall back to polling.

This futureproofs the code and gives more robustness in the case of
problems.

https://bugzilla.gnome.org/show_bug.cgi?id=707402
goaidentity: drop dead code

We used to have to get the "raw credentials" from the kerberos
credential cache for realmd to use.  We no longer need that
so drop that code.

https://bugzilla.gnome.org/show_bug.cgi?id=707402
kerberos: make sure first KEYRING credential is automatically selected

Right now, we ensure the first DIR type signed in kerberos identity
gets selected automatically.  We should do the same for KEYRING types
as well.

To better future proof the code, assume future keyring types will
support multiple identities going forward.

https://bugzilla.gnome.org/show_bug.cgi?id=710116
kerberos: correctly show sign in errors when mistyping password

Right now if a user toggles the kerberos switch on, and then
mistypes their password, we pretend like everything succeeded.

This commit makes sure we report the failure and also makes sure
we show a Sign In button so the user can try again.

https://bugzilla.gnome.org/show_bug.cgi?id=709955
goaalarm: add locks when setting up timers

An alarm could be getting set in one thread while getting
cleared in another.  We need to protect against that.

https://bugzilla.gnome.org/show_bug.cgi?id=709953
Prepare 3.8.5