Update shlib.conf for FreeBSD

FreeBSD has not emitted a.out binaries by default for a very long
time; elf is the standard.

Take sparc64 conditional for PICFLAGS from downstream.

Enable "new" dtags (supported since FreeBSD 5.0) -- this
prevents rpath entries in libraries from taking precedence over
LD_LIBRARY_PATH, useful for testing.
Add a krb5_db_check_pkinit_binding() to libkdb

Provide a way for kdb modules to decide whether or not a given client
certificate corresponds to a particular client principal.
Use krb5_db_check_pkinit_binding() in the KDC

If we can't find a matching SAN in the client's certificate, call
krb5_db_check_pkinit_binding() to check if the supplied certificate
matches the client in question.  If the kdb method doesn't return TRUE,
then we've failed.  This doesn't alter any other requirements we have
for client certificates.
Provide a check_pkinit_binding() method

Provide a check_pkinit_binding() function which checks the client's
directory server entry for a userCertificate value that's byte-for-byte
the same as the one we've been given to compare to.