Make kadmin ext work when lacking get-keys priv

When we added the get-keys privilege we lost the ability to setup
keytabs with the kadmin ext command.  The fix is to note that we got
bogus key data and randkey (as we used to).
Document that ext_keytab can change a princ's keys