ws: Implement basic GSSAPI kerberos authentication

The actual authentication happens in cockpit-session, which has
access to the keytab
ws: Implement basic testing of kerberos auth during 'make check'

This requires the 'krb5-server' package or similar to be installed
while running 'make check'
static: Try an SSO login before showing the login form

This allows kerberos (ie: Negotiate, GSSAPI) SSO authentication to
happen before showing a login form.
ws: Send WWW-Authenticate: Negotiate header for any auth failure
ws: Test kerberos against host@COCKPIT keytab credentials

This is how it is used with Active Directory, and not necessarily
with HTTP specific kerberos SPN.
ws: If we can't resolve a real local name, use fully qualified

Use fully qualified kerberos user name if we cannot resolve it
into a valid local user via the kerberos routines.
static: Don't use single sign-in if user explicitly logged out

When the user explicitly logged out, don't try and use single
sign in to authenticate. Otherwise the user would just be logged
in again.

There are two use cases here:

 * The user wants to finish the session and log out
 * The user wants to log in as someone else

So we force display of the login form in the case where logout
was explicitly used.
test: Check negotiate authentication
selinux: cockpit-session uses GSSAPI which wants to write to tmpdir

GSSAPI writes to a replay cache. cockpit-session now uses GSSAPI
and needs to be able to write, read, delete from tmpdir

Symptom:

cockpit-session: gssapi auth failed: Unspecified GSS failure.
	Minor code may provide more information (Cannot create replay
	cache file /var/tmp/HTTP_0: File exists)
HACKING: Add instructions for how to configure SSO

This is a bit convoluted currently, but it's important to make this
reproducable and for people to be able to develop against it ... or
it will never ever get better.