Modify k5buf interfaces for easier use

Make struct k5buf less opaque and get rid of k5buf-int.h.  Make it
easy to initialize a k5buf in an error state so that it can be freed
in a cleanup handler.  Add a function k5_buf_status which returns 0 or
ENOMEM.  Remove k5_buf_data and k5_buf_len.  Rename k5_free_buf to
k5_buf_free.  Adjust all callers to match.
Adjust marshalling interfaces for KCM

Make k5_marshal_cred and k5_marshal_princ write to an existing struct
k5buf instead of allocating a new one, so that they can be marshalled
before or after other data.
Add KCM credential cache type (client only)

Add a new credential cache type "KCM" which performs cache operations
by speaking to a Heimdal or OS X KCM daemon, via either Unix domain
sockets or (on OS X only) Mach RPC.  Add "kcm_socket" and
"kcm_mach_service" profile variables to control the socket path and
bootstrap service name respectively.  In ccmarshal.c, add
k5_marshal_mcred to marshal matching credentials in the KCM protocol
representation.

This cache type is not currently supported on Windows, as Windows does
not support Unix domain sockets.

As with the keyring cache type, the lastchange method of this cache
type is mostly useless, reporting only the time of the last change
made through that cache handle.  The KCM protocol currently has no
support for obtaining the last change time of the cache itself.

ticket: 7964 (new)
Make KCM the default ccache on OS X

If we do not find a default ccache value from krb5-config and we
detect that the host platform is OS X 10.7 or higher, use KCM: as the
default ccache name instead of FILE:/tmp/krb5cc_%{uid}.

ticket: 7964
Document KCM ccache type

Document the new KCM ccache type in ccache_def.rst.  Document the
kcm_socket and kcm_mach_service variables in krb5_conf.rst.

ticket: 7964
Add flag word to KDB iteration APIs
Support write locks in DB2 iteration

Add support to krb5_db_iterate() for requesting write locks in the DB2
back end.
Use write lock flag for update_princ_encryption

In kdb5_util update_princ_encryption, instead of getting a write lock
on the KDB surrounding the call to krb5_db_iterate(), use the
iterflags parameter of krb5_db_iterate() to request that it obtain a
write lock around the iteration.
Support unlocked iteration in DB2

Add support to the DB2 KDB back end to optionally release the lock
when calling the iterator callback.  This prevents the blocking of
other processes when dumps of large databases are taking place.

Also add support for reversed iteration.
Stop locking around iprop dumps
Ignore iprop deletion of deleted princ

Now that an iprop full dump might not hold a lock around the entire
dump, it's possible that iprop will queue an incremental update while
the dump is in progress.  If a principal is deleted while the dump is
in progress, the dump could omit that principal, yet the deletion
event would still be queued in the ulog.  Ignore that deletion without
generating an error.
Document unlockiter somewhat
Support kdb5_util dump -rev again

Restore kdb5_util dump support for reversed dumps.