Add helper to change extended error message code

k5_change_error_message_code allows an extended error message to be
used when an error code is remapped.
Use k5_change_error_message_code in krb5 GSS mech

Simplify acquire_accept_cred using the new helper function.
Improve krb5_rd_req decryption failure errors

When krb5_rd_req cannot decrypt a ticket, try to produce the most
helpful diagnostic we can, and return an error code which corresponds
to the most applicable Kerberos protocol error.  Add a trace log
containing the error message for ticket decryption failures, in case
the application server does not log it.

Add new tests to cover krb5_rd_req error messages and adjust existing
tests to match the new messages.  Also adjust svc_auth_gssapi.c to
look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC.

ticket: 7232
Don't remove ccache creds before storing them

Revert #6291, which attempts to suppress duplicate credentials by
calling krb5_cc_remove in krb5_cc_store_cred.  Most of our ccache
types don't implement remove_cred, and avoiding duplicate credentials
is a responsibility better suited to the ccache implementation for
atomicity reasons.

Removing this call gets rid of the misleading "Removing ... from ..."
messages in trace logs.

ticket: 7906 (new)
Add way to check if mechlistMIC must be produced

This is an extension that is needed to work around a bug in Micorsoft's
SPNEGO implementation when the mechanism used is NTLMSSP and a MIC is
produced internally by this mechanism when this is the preferred
mechanism for the client.

In such case Microsoft servers require a mechlistMIC to be produced even
if RFC 4178 (c) says it should be optional.
In order to avoid interoperability problems this function checks if a
MIC has been produced internally and if so set sc->mic_reqd to 1 forcing
us to emit a mechlistMIC.

This function is intentioannly called after every gss_init_sec_context()
although only the second call can actually return a meaningful answer. The
first call is used to signal to the mechanism that the SPNEGO layer does
support forcing a mechlistMIC so that the mechanism does not put a MIC in
the Authenticate message at all if forcing a mechlistMIC is not supported.

Signed-off-by: Simo Sorce <simo@redhat.com>