Add a krb5_db_check_pkinit_binding() to libkdb

Provide a way for kdb modules to decide whether or not a given client
certificate corresponds to a particular client principal.
Use krb5_db_check_pkinit_binding() in the KDC

If we can't find a matching SAN in the client's certificate, call
krb5_db_check_pkinit_binding() to check if the supplied certificate
matches the client in question.  If the kdb method doesn't return TRUE,
then we've failed.  This doesn't alter any other requirements we have
for client certificates.
Provide a check_pkinit_binding() method

Provide a check_pkinit_binding() function which checks the client's
directory server entry for a userCertificate value that's byte-for-byte
the same as the one we've been given to compare to.