Fix more password_policy cleanup code

Initialize policy_dn in krb5_ldap_create_password_policy; free values
unconditionally in all ldap_pwd_policy.c cleanup handlers.
Fix kdb_ldap_create_principal cleanup

entry must be initialized before all code which can jump to cleanup.
Clean up cksum handling in CMAC token functions

In krb5int_dk_cmac_encrypt, cksum wasn't used.  In
krb5int_dk_cmac_decrypt, cksum needs to be initialized since we clean
it up.
Using k5-int.h data helpers for some functions

Use empty_data(), alloc_data(), and make_data() in some appropriate
places.  This has the side effect of initializing the krb5_data magic
field, which can placate debugging tools.
Simplify krb5_ldap_readpassword

There's no need to check whether the file exists and is readable
before opening it, and setting an extended error message which is just
strerror_r() of the errno value isn't useful.
Fix errno hygiene in kadmind write_pid_file

fclose() might overwrite the errno value from fprintf, causing us to
return success when we shouldn't.  Record the errno value at the time
of the fprintf failure.
Fix typo in ktest_make_sample_auth_pack
Fix zap size in confounder checksum mk_xorkey
Free unconditionally in plugins.c

Get rid of unnecessary null checks before freeing values in
libkrb5support's plugin code.
Reformat tests/gss-threads
Fix warnings in tests/gss-threads