Do not default to host/ for client keytabs

When the normal (acceptor) keytab is being used to obtain initial
credentials, it is reasonable to use the default hostbased service
principal (host/fully.qualified.localhost.domain) when no client
principal is given.  This behavior is not very reasonable when
the default client keytab is being used, as host/ credentials are
not normally client credentials.

Make kinit -i match up with the GSS-API behavior when client keytabs
are in use, using the name of the first entry in the keytab when
no name is explicitly given.

ticket: 7892
Test that kinit -k -i picks the intended principal

Prior to ticket 7892 it would use the default host/ principal
when no principal was given on the command line.

ticket: 7892
Remove dead code from the mechglue initialization

The stat check in gss_indicate_mechs had no consequent and would have
been redundant with logic in updateMechList if it did.

[ghudson@mit.edu: elaborated commit message; removed unused
g_mechSetTime and now-irrelevant comment]
Load mechglue config files from /etc/gss/mech.d

In addition to loading /etc/gss/mech, glob for *.conf files in
/etc/gss/mech.d.  Load only config files which have changed since the
highest mtime we saw in the previous scan.  Scan at most once per
second to avoid excessive numbers of filesystem syscalls for busy
GSSAPI applications.

[ghudson@mit.edu: rewrote commit message; style changes; added
once-per-second throttle on glob/stat calls]

ticket: 7882 (new)
Document /etc/gss/mech.d/*.conf

[ghudson@mit.edu: editorial changes]
Fix fencepost error in krad timeout handler

ticket: 7911
target_version: 1.12.2
tags: pullup
Improve pointer hygiene around gss_display_name

GSSAPI functions are responsible for setting their output parameters
on failure.  Take greater care to do so in krb5_gss_display_name.

The mechglue is generally defensive about initializing variables used
as outputs, and not assuming that mechs will set them on failure.
Make gssint_convert_name_to_union_name initialize
union_name->external_name before calling mech->gss_display_name, so
that if the mech's gss_display_name doesn't touch it, we don't free an
uninitialized pointer.

Either one of these changes prevents an unlikely memory bug which
could occur if krb5_gss_init_context fails within
krb5_gss_display_name when called from
gssint_convert_name_to_union_name.

ticket: 7915 (new)
target_version: 1.12.2