Refactor KDC option/flag processing

A lot of KDC code was spent copying options to flags, and copying
header_ticket flags to the output ticket.

Previous code didn't copy PROXY from the header_ticket, but this seems
to have been a minor bug rather than intentional.