Fix KDC lock persistence on error conditions

If k5db2_dbopen() returns an error, krb5_db2_lock() can return an
error without unlocking the lock file.  This lock will persist until
krb5_db2_lock() executes successfully, preventing kadmind from making
changes to the KDB.  One possible trigger is running out of file
descriptors.

ticket: 7717 (new)
version_fixed: 1.9.6