Make ksu respect the default_ccache_name setting

Move logic for resolving and initializing a cache that we're copying
creds into out of krb5_ccache_copy(), and let the caller deal with it.
Add a helper functions to select/resolve an output ccache in the default
location for the target user after we've switched to the target user's
privileges.  If the destination is a collection, take care not to change
which subsidiary is its primary, and reuse a subsidiary cache if we can.
If the destination is not a collection, continue to use a per-run cache.
Copy config entries to the ksu target ccache

When we try to screen out expired creds while reading them from one
ccache to eventually store in another, also keep configuration entries.
Use more randomness for ksu secondary cache names

When generating a suffix to append to a ccache name that will hold the
credentials for a ksu-invoked process, instead of using integers
counting up from 1, use the result of base64-encoding six randomly-
generated octets.  Tweak the output alphabet just a bit to avoid using
'+' or '/' in the generated names, the latter of which could really
confuse things.