gplazma: Remove internal principals from reply

Addresses compatibilty issues between 2.2 head nodes and 1.9.12 pools.

Some plugins, like the kpwd plugin, do not fill well into gPlazma 2's
architecture. The kpwd file plays the role of all four steps of a
gPlazma login and the plugin must do tricks to pass information from
one phase to the next. It does this by injecting a KpwdPrincipal that
holds the kpwd record.

Unfortunately, this principal escapes gPlazma and is passed along to
other dCache components as part of the Subject. Besides exposing
plugin specific internal principals, and making the subject unnecessarily
larger, this poses a compatbility problems with 1.9.12 pools - these
pools do not have the means to deserialize the internal KpwdPrincipal.

This patch solves the problem by removing all non-public principals
before constructing the gPlazma reply.

Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Patch: http://rb.dcache.org/r/5487/
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>