Fix krb5int_c_combine_keys

When krb5int_c_combine_keys was updated to use the new crypto
interface, a small bug was introduced.  It turns out the temporary
keyblock created needs to have its enctype set; otherwise, when
krb5int_derive_keyblock() is called later, it will fail with
KRB5_BAD_ENCTYPE.

ticket: 7914
target_version: 1.12.2
tags: pullup
Add tests for krb5int_c_combine_keys

krb5int_c_combine_keys is used only by SAM-2 preauth with neither the
send-encrypted-sad nor use-sad-as-key flags, so it isn't covered by
any automated function tests.  Add some unit tests to make sure that
it works and returns the expected results for two randomly generated
test vectors.

ticket: 7914
target_version: 1.12.2
tags: pullup
Unlocked db2 KDB iteration

Try to make an optional db2 iterator that unlocks (and therefore
closes) the KDB between iterations, to allow large KDBs to be dumped
without blocking writes for a long time.

This is a hackish proof of concept.  It won't work for all consumers
of db_iterate, especially ones that need to hold other locks while
iterating.