Support S4U2proxy settings in db2 plugin

Use the "allowed_to_delegate_to" string attribute to determine when
S4U2proxy can be performed. The value should take the form of “proxy1
proxy2…”. proxy1 (and proxy2...) can also be * to match all principals.
It MUST NOT include the realm name.