Document preauth flags for service principals

These flags are overloaded to mean different things for clients and
servers; previously we only documented the client behavior.

ticket: 7653 (new)
tags: pullup
target_version: 1.11.4
Clarify retiring-des based on user feedback

Explain why DES keys should be removed from principals, and clarify
that allow_weak_crypto overrides all other configuration.

ticket: 7654 (new)
tags: pullup
target_version: 1.11.4
Clean up dangling antecedent in allow_weak_crypto

The "previous three lists" are not previous any more.
Say explicitly which three lists, and make the parenthetical bind
to the correct noun.

ticket: 7655 (new)
tags: pullup
target_version: 1.11.4