Add a krb5_db_check_pkinit_binding() method to kdb

Add a callback for kdb modules which will allow them to return a boolean
indicating whether or not a passed-in client certificate (as a single
binary blob) corresponds to the principal of a particular kdb entry.
We'll call it as a fallback if the PKINIT server plugin doesn't find the
expected principal name in the certificate.
Use krb5_db_check_pkinit_binding() in the KDC

If we can't find a matching SAN in the client's certificate, call
krb5_db_check_pkinit_binding() to check if the supplied certificate
matches the client in question.  If the kdb method doesn't return TRUE,
then we've failed.  This doesn't allow the kdb method to alter any other
requirements we have for client certificates (i.e., we still have to
trust the issuer, and we still check that before we reach this point).
Provide a kdb-ldap check_pkinit_binding() method

Provide a check_pkinit_binding() function for the ldap kdb plugin which
checks the client's directory server entry for a userCertificate value
that's byte-for-byte the same as the one we've been given to compare to.