Simplify and improve ksu cred verification

When verifying the user's initial credentials, don't compute a server
name and preemptively obtain creds for it.  This change allows
krb5_verify_init_creds to use any host key in the keytab, and not just
the one for the canonicalized local hostname.

[ghudson@mit.edu: rewrote commit message]

ticket: 7996 (new)
target_version: 1.13
tags: pullup
kadm5_randkey_principal interop with Solaris KDC

When kadm5_randkey_principal is called on Solaris kadmind (as opposed
to kadm5_randkey_principal_3), the KDC assumes the peer is a Solaris 9
system, and only creates DES keys.

For better interoperability, always call kadm5_randkey_principal_3
first.  If this procedure is not present on the remote server, fall
back to calling kadm5_randkey_principal if possible.

[ghudson@mit.edu: adjusted comments, argument wrapping, commit
message]

ticket: 7997 (new)
target_version: 1.13
tags: pullup
Make randkey update principal mkvno

In kadm5_randkey_principal_3, after updating the principal's keys,
update its mkvno tl-data to indicate the master key version we
encrypted the new keys with.

ticket: 7994
target_version: 1.13
tags: pullup
Add test case for randkey mkvno update

ticket: 7994