Add missing .gitignore entries and clean rules

ticket: 7585
Add krb5_free_enctypes API

Rename krb5_free_ktypes to krb5_free_enctypes and add it to the public
API.

ticket: 7584
Fix a memory leak in krb5_get_init_creds_keytab

lookup_etypes_for_keytab was not freeing the keytab entries it
iterated over.  Reported by nalin@redhat.com.

ticket: 7586
target_version: 1.11.2
tags: pullup
Simplify and clarify lookup_etypes_for_keytab
Fix dependencies in tests/gssapi

Use $(COMMON_DEPS) instead of $(COMMON_DEPLIBS) for dependencies; the
latter appears to be a typo.  Fixes build when using "make -j".

ticket: 7587 (new)
target_version: 1.11.2
tags: pullup
Add a krb5_db_check_pkinit_binding() to libkdb

Provide a way for kdb modules to decide whether or not a given client
certificate corresponds to a particular client principal.
Use krb5_db_check_pkinit_binding() in the KDC

If we can't find a matching SAN in the client's certificate, call
krb5_db_check_pkinit_binding() to check if the supplied certificate
matches the client in question.  If the kdb method doesn't return TRUE,
then we've failed.  This doesn't alter any other requirements we have
for client certificates.
Provide a check_pkinit_binding() method

Provide a check_pkinit_binding() function which checks the client's
directory server entry for a userCertificate value that's byte-for-byte
the same as the one we've been given to compare to.