Fix GSS-TSIG dns authentication

Somewhere along the way broker_dns_gsstsig class parameter got refactored out by mistake so we were never
attempting to deploy a kerberos based nsupdate config.

Fixed by :
  * Using kerberos nsupdate config whenever bind_krb_principal != ''
  * Remove the composition of "DNS/$bind_krb_principal@$broker_krb_auth_realms" because folks may use
  different realms for broker and dns auth. Also, we're naming the variable 'principal' so lets just have
  users provide a principal. There's risk here that folks would expect the previous behaviour, but given that
  the code path would never have been executed as it was I think this is a sane change.