Avoid writing krbLastAdminUnlock during auditing

Try to avoid writing krbLastAdminUnlock when we're just doing auditing
in the KDC.  Because we know that kdb5_ldap_put_principal() only writes
the attribute when it's nonzero, we temporarily reset the value to make
sure that it isn't written.  This approach is a bit of a hack, but it
keeps the number of code paths affected by this change low.