Make empty passwords work via init_creds APIs

In the gak_data value used by krb5_get_as_key_password, separate the
already-known password from the storage we might have allocated to put
it in, so that we no longer use an empty data buffer to determine
whether we know the password.  This allows empty passwords to work via
the API.

Remove the kadm5 test which explicitly tests with an empty password.

Based on a patch from Stef Walter.

ticket: 7642