Correct includes for unlockiter.c

Some platforms (e.g., Solaris) need a declaration of memset() for the
FD_ZERO() macro to work, contrary to POSIX standards.  Add an
inclusion of <string.h> to accommodate them.  Also add <sys/time.h>,
possibly needed by some older platforms, and remove a spurious
inclusion of <sys/socket.h>.

ticket: 7977
Make ksu accept .k5users principal-only lines

The ksu docs indicate that a line in .k5users which contains only a
principal name (i.e., no trailing commands) is treated the same as
it would be if it contained "*" as a command, but this was previously
only the case when no command was specified on the command line.
Extend that behavior so that they are treated as the same when a command
is specified, too.
In ksu, make .k5users "*" also match shells

When ksu was explicitly told to spawn a shell, a line in .k5users which
listed "*" as the allowed command would cause the principal named on the
line to be considered as a candidate for authentication.

When ksu was not passed a command to run, which implicitly meant that
the invoking user wanted to run the target user's login shell, knowledge
that the principal was a valid candidate was ignored, which caused some
confusion.

This doesn't impact the authorization checks which we perform later.