Fix ksu crash in cases where it obtains the TGT

In order to allow ksu to use any locally-present service key for verifying creds, the previous change to ksu switched from using a retrieved or obtained TGT to fetch creds for the local "host" service, and then passing those creds to krb5_verify_init_creds(), to passing the retrieved TGT directly to krb5_verify_init_creds().  It did not take care to retrieve the TGT from the temporary ccache if it had obtained them, and in those cases it would attempt to verify NULL creds.