kadm5_randkey_principal interop with Solaris KDC

When kadm5_randkey_principal is called on Solaris kadmind (as opposed
to kadm5_randkey_principal_3), the KDC assumes the peer is a Solaris 9
system, and only creates DES keys.

For better interoperability, always call kadm5_randkey_principal_3
first.  If this procedure is not present on the remote server, fall
back to calling kadm5_randkey_principal if possible.

[ghudson@mit.edu: adjusted comments, argument wrapping, commit
message]

ticket: 7997 (new)
target_version: 1.13
tags: pullup
Make randkey update principal mkvno

In kadm5_randkey_principal_3, after updating the principal's keys,
update its mkvno tl-data to indicate the master key version we
encrypted the new keys with.

ticket: 7994
target_version: 1.13
tags: pullup
Add test case for randkey mkvno update

ticket: 7994