Enforce minimum PBKDF2 iteration count

Also add a testing interface to allow weak iteration counts.
(Published test vectors use weak iteration counts.)

(cherry picked from commit 7a7736a3ea321aeb4b281ae2712e27becb00d720)

ticket: 7465
version_fixed: 1.12
status: resolved
Set expiration time on keys and keyrings

By setting the timeout based on the credetial's timeout we let the
system automatically cleanup expired credentials.

[ghudson@mit.edu: simplified code slightly]

(cherry picked from commit 29e60c5b7ac0980606971afc6fd6028bcf0c7f0f)

ticket: 7769
version_fixed: 1.12
status: resolved
Add support to store time offsets in cc_keyring

The code follows the same model used for the memory ccache type.  Time
offsets are stored in each credential cache in a special key just like
the principal name.  Legacy session caches do not store timestamps as
legacy code would fail when iterating over the new offset key.

[ghudson@mit.edu: minor formatting changes; note legacy session
exception in commit message]

(cherry picked from commit fb4817a32d0c369049e0868468dd2eb75487630d)

ticket: 7768
version_fixed: 1.12
status: resolved
Remove dangling --with-kdc-kdb-update references

This configure option hasn't done anything since 1.8, so don't mention
it in configure --help or the documentation.  The disable_last_success
and disable_lockout DB options are now used to turn it off.

(cherry picked from commit 0b3225d63f50d4e6297be5d751cae1d3368fcdb1)

ticket: 7771 (new)
version_fixed: 1.12
status: resolved