Define k5-platform.h wrapper for strerror_r

On systems where strerror_r is not the POSIX version, define it to
k5_strerror_r.  Implement k5_strerror_r in libkrb5support using
strerror_s, strerror, or the GNU strerror_r as appropriate.

ticket: 7961
Simplify usage of strerror_r

Take advantage of the strerror_r portability wrapper to simplify code
using it.  Remove unused macros related to strerror_r in
ldap_service_stash.c and plugins.c.

ticket: 7961
Include autoconf.h before system headers

Include autoconf.h (either directly or via proxy) before system
headers, so that feature test macros defined there can affect the
system namespace.  Where include order was changed, eliminate some
redundant or unnecessary includes.

ticket: 7961
Define _GNU_SOURCE for glibc extensions

glibc does not declare a number of common, useful extensions such as
asprintf unless _GNU_SOURCE is defined.  Define it early in the
configure process so that it is available for autoconf tests.

Defining _GNU_SOURCE unfortunately causes glibc to use the non-POSIX
version of strerror_r, which we now handle using the k5-platform.h
wrapper.

ticket: 7961
make depend
ksu: handle referrals in the local service name

When ksu needs to verify the source user's TGT, it obtains a service
ticket which it passes to krb5_verify_init_creds().  If the service
principal name contains the referral realm, krb5_verify_init_creds()
will substitute the default realm name and, seeing that the result
differs from what's passed in, attempt to fetch the ticket again.  Save
the trip by decoding the ticket and using the service principal name
supplied by the KDC.

This also avoids a corner case where that service ticket could not be
verified if its remaining life was less than five minutes.