Make ksu parse .k5users principal-only lines right

The ksu docs indicate that a line in .k5users which contains only a
principal name (i.e., no trailing commands) is treated the same as
it would be if it contained "*" as a command, but this was previously
only the case when no command was specified on the command line.
In ksu, make .k5users "*" also match shells

When ksu was explicitly told to spawn a shell, a line in .k5users which
listed "*" as the allowed command would cause the principal named on the
line to be considered as a candidate for authentication.  When ksu was
not passed a command to run, which implicitly meant that the invoking
user wanted to run the target user's login shell, that candidacy was
being thrown away, which caused some confusion.