Try to scan_ccache() after leash picks a cache

We need to call scan_ccache() in order to notice that there
are credentials and read their expire time.

The call to scan_ccache() in the Leash case was inadvertently
removed as part of commit 8651f3339ccc5a623172a8edfb9cf522883acacd.

(cherry picked from commit 674f7d7abe2d4f8bc3fe791e4347a332e3ccfd41)

ticket: 7998
version_fixed: 1.13
status: resolved
Add some KDC entries to the registry via WiX

Though our library happily uses DNS, I can't get Windows to
successfully contact KDCs found through the SRV records.
So, we do need to stay in the business of shipping around
KDC entries, after all.

(cherry picked from commit d2b76e1ba0f4bb0ec7e560a9a681d938f45f950c)

ticket: 7999
Let libgssapi see TGTs in the MSLSA cache

When the current user is a local administrator of a windows machine
where User Account Control (UAC) is enabled, the Windows LSA will
return a block of zeros as the session key for any TGT entry in the
MSLSA: cache.  The lcc_retrieve() implementation checks for such
"null" session keys and prevents them from escaping to callers (as
attempts to use them would encounger strange errors).  However,
when the TGT is the only entry in the cache, this filtering prevents
scan_ccache() from detecting that the cache contains non-expired
credentials (and that there is a TGT present).

Since scan_ccache() is only looking at metadata in the cache entries,
and does not need to actually use any tickets or session keys, set
the KRB5_TC_NOTICKET flag on the ccache before scanning it.  This
will allow the MSLSA implementation to return a cred for the TGT
entry and cause the GSSAPI credential selection algorithm to function
properly.

(cherry picked from commit 0794746f8d8e6b8ce3748d442d2bc1faecf960ce)

ticket: 8000
version_fixed: 1.13
status: resolved