Correct docs for "kdb5_util load" switches

Remove obsolete parenthetical statement in the description of the
"-update" switch to "kdb5_util load".  Using the "-update" flag to
load a second dump made using the "-ov" switch is no longer necessary
now that the "-r13" format is the default.  Add statement that the
"-b7" dump format was the default for versions prior to 1.2.2 (to
match the statement from "dump" section).

[tlyu@mit.edu: commit message]

(cherry picked from commit 2d0f2fa48df1ea81363de5c78ab7e8cf1ab6d214)

ticket: 7865
version_fixed: 1.12.2
status: resolved
Conditionalize use of LDAP_OPT_DEBUG_LEVEL

The LDAP debug level option (#7551) causes a build failure with the
Solaris LDAP library, which does not have LDAP_OPT_DEBUG_LEVEL.

(cherry picked from commit 0364d0da094be0fbf3a9a08b79b6e23eaaf0d2d7)

ticket: 7870
version_fixed: 1.12.2
status: resolved
Check for malloc failure in process_chpw_request

(cherry picked from commit 4356deefa2d2fe0bc7b52f3b62a387c7ec1eb369)

ticket: 7866
version_fixed: 1.12.2
status: resolved
Update iprop_master_ulogsize documentation

When we removed the maximum number of ulog entries (#7368), we did not
update the documentation for that parameter in kdc.conf.  Reported by
Richard Basch.

(cherry picked from commit 5fa7e666bd81a2222b155bdf3f0c3fc1bc3fabf5)

ticket: 7849
version_fixed: 1.12.2
status: resolved
Initialize err variable in krb5_sendto_kdc

When we get an KRB5_KDC_UNREACH error back from k5_sendto, we check if
the err variable we passed for use by our message handler has been set
to KDC_ERR_SVC_UNAVAILABLE.  If k5_sendto doesn't receive any
response, though, the handler isn't called, so we're reading an
uninitialized variable.  Initialize it to a value other than
KDC_ERR_SVC_UNAVAILABLE to be sure.

[ghudson@mit.edu: initialize err just before calling k5_sendto; edit
commit message]

(cherry picked from commit 1ed3f68c2394fbb48731bba4e4e9a60c8b925ca5)

ticket: 7874
version_fixed: 1.12.2
status: resolved
Fix memory leak in krb5_verify_init_creds

When copying most of the credentials from one cache to another in
copy_creds_except (called from get_vfy_cred, from
krb5_verify_init_creds), we need to free all of the credentials that
we read, not just the ones we copied.

[ghudson@mit.edu: edited commit message]

(cherry picked from commit 27b136d2e3181e787b2d4a03ee712d5d5137f5cd)

ticket: 7875
version_fixed: 1.12.2
status: resolved
Mention k5login_authoritative in k5login docs

In particular, it is set by default.  This can lead to confusing
behavior wherein adding a k5login file removes a user's remote
access.

Make an example more concrete to account for this case.

(cherry picked from commit 8cdc21ef051f43ea8dcabf42540d5cff13b5adeb)

ticket: 7876
version_fixed: 1.12.2
status: resolved
Don't leak the per-request preauth context

Currently, per-request preauth module data is only cleared when we
successfully obtain initial credentials.  Make sure to clear it at the
end of the operation even if we failed to get creds.

[ghudson@mit.edu: expanded commit message]

(cherry picked from commit a47c4e68308331a630480cb62c2b7711432e0123)

ticket: 7793
version_fixed: 1.12.2
status: resolved