Add flag word to KDB iteration APIs
Support write locks in DB2 iteration

Add support to krb5_db_iterate() for requesting write locks in the DB2
back end.
Use write lock flag for update_princ_encryption

In kdb5_util update_princ_encryption, instead of getting a write lock
on the KDB surrounding the call to krb5_db_iterate(), use the
iterflags parameter of krb5_db_iterate() to request that it obtain a
write lock around the iteration.
Support unlocked iteration in DB2

Add support to the DB2 KDB back end to optionally release the lock
when calling the iterator callback.  This prevents the blocking of
other processes when dumps of large databases are taking place.

Also add support for reversed iteration.
Ignore iprop deletion of deleted princ

Now that an iprop full dump might not hold a lock around the entire
dump, it's possible that iprop will queue an incremental update while
the dump is in progress.  If a principal is deleted while the dump is
in progress, the dump could omit that principal, yet the deletion
event would still be queued in the ulog.  Ignore that deletion without
generating an error.
Support kdb5_util dump -rev again

Restore kdb5_util dump support for reversed dumps.