Clarify and improve k5_json_object_set

Document that k5_json_object_set can be used to overwrite an existing
key, and make it possible to remove a key by setting it to NULL.
Fix OTP KDC module get_string error handling

If cb->get_string returns 0 with no result in otp_edata, make sure we
set retval to avoid sending an empty OTP hint.  If cb->get_string
returns an error code in otp_verify, avoid masking that code.