Don't use expired TGTs in TGS-REQs

ticket: 6948
Better fix for not using expired TGTs in TGS-REQs

We want to generate a KRB5_AP_ERR_TKT_EXPIRED code when the TGT is
expired, like we would if we tried the TGT against the KCD.  To make
this work, separate the helpers for getting local and crossrealm
cached TGTs.  For a crossrealm TGT, match against the endtime, as
there could be multiple entries.  For a local TGT, find any match, but
check if it's expired.  The cache_code field is no longer needed after
this change, so get rid of it.

ticket: 6948
Add internal KDC_DIR macro

Define KDC_DIR in osconf.hin and use it for paths within the KDC
directory.
Don't fail if a candidate certificate has no SANs

Don't return an error, which will eventually cause the module to just
return an error, if we don't find any SANs in the candidate certificate:
just return the empty list of values so that processing can continue on
to other certificates.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.  Failures to parse PKCS12 data due to
reasons other than not having a decryption password probably didn't end
well before now.
Traverse tokens like we do with OpenSSL for NSS

When built with NSS, change our token traversal strategy to mimic the
way we do things when we're using OpenSSL: forget about slot names, and
only look at the specified token, or the first one if one isn't
specified.
When DEBUG=1, log why we fail to log in to a token
NSS: load certificates first

In order to work around RHBZ#859535, when loading a certificate and a
key, switch to loading the certificate first.
Fix loading of certificates

When loading certificates using the PEM module, use a better method for
finding the just-loaded certificate that doesn't break if we've already
got a copy of the certificate somewhere.
NSS: support encrypted PEM keys

When the PEM module is given an encrypted key, it changes its status to
indicate that a password is required.  So if we detect that after
loading a private key, attempt to "log in" to the "token" using a
password.  Even if we fail, we'll have reset the needs-login flag, which
is necessary before we can import anything else.
Candidate fix for some refcounted-resource leaks