Use a fake temporary cache client principal in ksu

Add a paramter to krb5_ccache_copy() which will provide the principal
name for which the target ccache should be created.  Using a fake value
("_ksu/_ksu@_ksu") when we copy the source user's creds to a MEMORY
cache should prevent us from accidentally selecting it when we make a
subsequent call to krb5_cc_cache_match() (to be added in a later patch)
to find a location where the creds should be stored for use while
running as the target user.
Make ksu respect the default_ccache_name setting

Move logic for resolving and initializing a cache that we're copying
creds into out of krb5_ccache_copy(), and let the caller deal with it.
Add helper functions to pull the default location from the configuration
and resolve any substitutions in it, and to select/resolve an output
ccache using that location after we've switched to the target user's
privileges.  If the destination is a collection, take care not to change
which subsidiary is its primary, and reuse a subsidiary cache if we can.
If the destination is not a collection, continue to use a per-run cache.

We move the declarations for k5_expand_path_tokens() and
k5_expand_path_tokens_extra() from os-proto.h to k5-int.h so that
they're declared for us to use.
Copy config entries to the ksu target ccache

When we try to screen out expired creds while reading them from one
ccache to eventually store in another, also keep configuration entries.
Use more randomness for ksu secondary cache names

When generating a suffix to append to a ccache name that will hold the
credentials for a ksu-invoked process, instead of using integers
counting up from 1, use the result of base64-encoding six randomly-
generated octets.  Tweak the output alphabet just a bit to avoid using
'+' or '/' in the generated names, the latter of which could really
confuse things.