Avoid infinite loop on duplicate keysalts

When duplicate suppression was requested, we would enter an
infinite loop upon encountering a duplicate entry, a bug
introduced in commit 0918990bf1d8560d74473fc0e41d08d433da1a15
and thus present in release 1.13.

Rework the conditional to avoid the loop, at the expense of
additional indentation for some of the code.

Ticket: 8038
tags: pullup
target_version: 1.13.1
Add tests for duplicate detection

There's not an easy way to test for infinite loops other than
making the test suite hang, unfortunately.
Don't fdopen() in append mode in cc_file.c

Implementations of fdopen() are inconsistent about the state of
the file offset after fdopen(., "a+") -- some position the stream
at the end of the file immediately (e.g., Solaris), for both reading
and writing, but others let reads occur from the beginning of the
file (e.g., glibc).

As it turns out, we only ever write to the file descriptor, not
through stdio, so opening the file with O_APPEND and using fdopen()
with "r+b" should give us sufficient append semantics, while
more portably letting the stream read from the beginning of the file.

This fixes the test suite on Solaris, a regression introduced
by commit 6979ead5e5c24ca0ec3569eb4bef48c2e5d8a726.

ticket: 8026
Remove ksu -D flag documentation

ksu -D does not work in the default build, so we should not document
it.  Remove any mention of it from the usage message and from ksu.rst.

[ghudson@mit.edu: edited commit message; omit change to generated man
page]

ticket: 8048 (new)
Do not crash ldap backend on keyless principals

Operations like "kadmin -q 'addprinc -nokey foo'" or
"kadmin -q 'purgekeys -all foo'" result in principal entries with
no keys present, so krb5_encode_krbsecretkey() would just return
NULL, which then got unconditionally dereferenced in
krb5_add_ber_mem_ldap_mod().

Rename the file-local helper to just encode_krbsecretkey() and
tweak its style slightly, and also return a krb5_error_code
so that krb5_ldap_put_principal() can handle encoding failures.
Make encode_krbsecretkey() create an empty berval entry, which
will delete any existing krbprincipalkey attribute when presented
with LDAP_MOD_REPLACE | LDAP_MOD_BVALUES.

The -purgekeys all feature appears to have never worked with the
LDAP backend since its introduction in release 1.12.

ticket: 8041 (new)
tags: pullup
target_version: 1.13.1
subject: kadmind with ldap backend crashes when putting keyless entries
Regression tests for keyless principals

Confirm that kadmind does not crash when creating/modifying a principal
to have no keys, and confirm that no keys are present after a
purgekeys -all.
Remove some dead code

The secretkey variable is initialized to NULL and compared against
NULL, but never actually set to anything after initialization.

Remove the variable and all code that would have executed if it
was non-NULL.