Invalidate credentials by predicate

Allow discarding any cached principal for a collection of credentials satisfying a given predicate.