First crack at CheckResponse

Note that both we and the client are using the master key for
the connection, not a derived transport key.

Change-Id: If4994ccaee0cd60ee0e817ac015f0b01db8ab03c
Add derive_tk

Derive a transport key from a connection master key.
Include our own local impelementation of PRF+, sigh, and also crib
the dummy etype_to_len function from rxgk_util.c.  The crypt and/or
gssapi stuff should be split off anyway so that people using the security
class bits don't need to know about gssapi.h.

Change-Id: I729bf1862540a8cd562db9584ff629c0d4e805d3
Use derived transport key for authenticator

In both client and server.

Change-Id: Idb0b21b71d6e3e8086aafaf0d9de5d988025be31