Fix minor memory leak in klist (again)

Commit 6e51f9cc3152c8e419fe7f459bcf521d60358434 attempted to fix two
minor memory leaks in klist, but one of the fixes was dead code.  In
do_ccache, free princ before we look at the code which terminated the
loop, not after we have returned on either branch.
Use gssalloc_malloc for GSS error tokens

In kg_accept_krb5, use gssalloc_malloc when allocating space for the
error token, since it will be freed with gssalloc_free.  Using malloc
can cause heap corruption on Windows.  This bug was masked by #1445
before 1.12.

ticket: 8024 (new)
target_version: 1.13.1
tags: pullup
Document that newer AFS supports stronger crypto

Modern OpenAFS releases support using encryption stronger than single
DES with Kerberos.  Update the documentation accordingly.

ticket: 7761
target_version: 1.13
tags: pullup
Separate ccache display and checking in klist

In klist, use separate functions to display a ccache and check its
status.  Also use a helper function to check if a credential's server
principal is the local krbtgt principal for the realm.
Improve klist check for expired cache

Make klist -s succeed for a cache which contains a non-expired
credential and no TGT cred.

ticket: 8022
Fix klist -A -s output

In show_all_ccaches, don't output newlines if status_only is set.
Add tests for klist -s
Better document how to verify PGP signature

Add text clarifying our unusual packaging of the PGP signature inside
a tar file.

ticket: 7927
target_version: 1.13
tags: pullup
Fix typo in doc for krb5_get_init_creds_keytab()

ticket: 7880
target_version: 1.13.1
tags: pullup
Update mitK5features.rst for 1.13
Parse "ktadd -norandkey" in remote kadmin client

The remote kadmin client would not parse the "-norandkey" option to
the ktadd subcommand, terminating option parsing and possibly causing
options to be interpreted as principal names.

ticket: 7962
target_version: 1.13.1
tags: pullup
Report output ccache errors getting initial creds

In init_creds_step_reply, if we get an error storing output
credentials, do set ctx->complete (since retrieving creds or times
will work at this point) but don't suppress the error code.

ticket: 8028 (new)
target_version: 1.13.1
tags: pullup
Add test for kinit output ccache error

ticket: 8028
Fix cursor leak in krb5_verify_init_creds

In copy_creds_except, call krb5_cc_end_seq_get so we don't leak the
ccache cursor.

ticket: 8029 (new)
target_version: 1.13.1
tags: pullup
Remove unused variables from kprop.c

Commit 29dee7d2cece615bec4616fa9b727e77210051db removed the
need for a ccache to hold the credentials used by the process,
but did not remove the ccname and ccache variables which became
unused as a result.
Make it easier to find ASN.1 codec functions

Expand out MAKE_CODEC macro invocations into MAKE_ENCODER and
MAKE_DECODER invocations, so that the defined function names appear in
the macro calls.  This makes it easier to find the function
definitions using grep, although one still has to look up the macro to
see what it does.