Fix verification of TGTs with lifetime < 5 minutes

When obtaining a service ticket for use in verifying a TGT, we request a
ticket with a lifetime of five minutes.  If the KDC returns credentials
that have a shorter lifetime (which is always the case if we're fetching
TGTs that are sufficiently short-lived), we end up storing them in the
temporary cache and then failing to find them when we search for them
immediately afterward.

To avoid this, after computing (now + 5 minutes) for use as the lifetime
of the desired credentials, if the TGT's endtime is lower, just use the
TGT's endtime.