Several minor authentication impromenents

1) Moving the Kerberos credential cache.  The Impala daemons will
fork/exec "kinit" upon startup and at regular intervals in order to
acquire a new ticket.  That ticket is stored in a file /tmp/krb5cc_xxx
where xxx is the UID of the process.  When run as the user 'impala',
this is fine, but if the Impala daemons are run as a different user,
it will blow away that user's credential cache.  Solution: set the
KRB5CCNAME environment variable to point to a custom filename in /tmp.

2) Added support for --krb5_conf, which supplies the location of a
non-standard krb5.conf file for kerberos.  Previously, two environment
variables had to be set by the caller.

3) Validated that --keytab_file actually points to a file before use.

4) Only append @ldap_domain if there isn't an @ already in user.  The
previous implementation would blindly apply the ldap domain to the end
of all users, even if a domain was already specified.

5) Added --krb5_debug_file to turn on kerberos debugging to that file.
Previously, two environment variables had to be set to enable this.

6) Consistantly logging authentication events for all permutations:
before/after, client/server, internal/external, and Kerberos/LDAP.

Change-Id: I84b4dd8c8bce0ab536ab4d52e216a6f9b44ca741
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/4538
Reviewed-by: Michael Yoder <myoder@cloudera.com>
Tested-by: jenkins