Add another kadmin ACL test for backreferences

Add a test using backreferences which don't correspond directly to
principal components, to verify that *N refers to the Nth wildcard and
not the Nth component.
Correct kadm5.acl back-reference documentation

In kadm5.acl, *N in the target principal name refers to the Nth
wildcard in the acting principal pattern, not the Nth component.

ticket: 7774 (new)
target_version: 1.12
tags: pullup
Improve default ccache name API documentation

Document the lifetime and caching behavior of the
krb5_cc_default_name() return value.  Document that
krb5_cc_set_default_name() may be called with NULL to purge the cached
value.  Correct a typo in the krb5_cc_default() summary and explicitly
reference krb5_cc_default_name().

ticket: 7775 (new)
target_version: 1.12
tags: pullup
Refactor KDC option/flag processing

A lot of KDC code was spent copying options to flags, and copying
header_ticket flags to the output ticket.

Previous code didn't copy PROXY from the header_ticket, but this seems
to have been a minor bug rather than intentional.