Hacky localauth support for bos

Only works on MIT krb5, and only works if you specify the fqdn
that matches the principal name.

Gets credentials and shoves them in a MEMORY: ccache, and uses
a gssapi_krb5 routine to set that ccache name for use as an initiator.
A better solution involves using gss_acquire_cred_from() to explicitly get
a credential from a keytab, and pass that to init_sec_context, but
that requires a lot of API changes, and it's unclear that we'll
even need this sort of thing (we may decide to put the token-encrypting
key on disk).