Fix GSS krb5 GSS_C_DELEG_FLAG ret_flags result

The krb5 gss_accept_sec_context could erroneously return
GSS_C_DELEG_FLAG in ret_flags if either:

* The token included the GSS_C_DELEG_FLAG but did not include at least
  28 bytes in the authenticator checksum.
* The initial token included the GSS_C_DELEG_FLAG but a DCE-style
  exchange was performed.

Fix both of these cases.

(cherry picked from commit d899084e24555dc8fd091eb08187ca2a45a08324)

ticket: 7987
version_fixed: 1.13
status: resolved
Make krb5_cc_new_unique create DIR: directories

When we use krb5_cc_new_unique to create a new cache in a directory
cache collection, we will fail if the directory doesn't exist yet.

Go ahead and preemptively create it, as we do during krb5_cc_resolve,
before attempting to create a new file under it.

(cherry picked from commit bca1191210eb582fe09e94486e2631d72b8a5ca5)

ticket: 7988
version_fixed: 1.13
status: resolved
Allow SPNEGO fallback to NTLM without mechlistMIC

For interoperability with Windows Server 2003 and earlier, loosen the
initiator's enforcement of RFC 4178's mechlistMIC requirement when
falling back to NTLMSSP.

[ghudson@mit.edu: rewrote commit message, added comment to NTLMSSP
OID]

(cherry picked from commit 7208dace8bfbdf5b930e26a19c8ff31c13ea1ef3)

ticket: 7975
version_fixed: 1.13
status: resolved