Review only: Add GSSAPI/Negotiate authentication when user has valid Kerberos ticket

Just for comment/review: updated tests aren't completed yet, but I would just like to get some input for now.

I broke it out into multiple detailed commits for now, but can/will rebase when everything is okay.

Associated [trello card](https://trello.com/c/zdflp3jX) and [use cases addressed](https://wiki.idm.lab.bos.redhat.com/export/idmwiki/IPA/Integration/OpenShift#4.1_RHC_-.3E_broker).

Pinging @kraman @smarterclayton @adelton