Add helper to change extended error message code

k5_change_error_message_code allows an extended error message to be
used when an error code is remapped.
Use k5_change_error_message_code in krb5 GSS mech

Simplify acquire_accept_cred using the new helper function.
Improve krb5_rd_req decryption failure errors

When krb5_rd_req cannot decrypt a ticket, try to produce the most
helpful diagnostic we can, and return an error code which corresponds
to the most applicable Kerberos protocol error.  Add a trace log
containing the error message for ticket decryption failures, in case
the application server does not log it.

Add new tests to cover krb5_rd_req error messages and adjust existing
tests to match the new messages.  Also adjust svc_auth_gssapi.c to
look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC.

ticket: 7232
Don't remove ccache creds before storing them

Revert #6291, which attempts to suppress duplicate credentials by
calling krb5_cc_remove in krb5_cc_store_cred.  Most of our ccache
types don't implement remove_cred, and avoiding duplicate credentials
is a responsibility better suited to the ccache implementation for
atomicity reasons.

Removing this call gets rid of the misleading "Removing ... from ..."
messages in trace logs.

ticket: 7906 (new)
Fix unlikely memory leak exporting lucid context

If the GSSAPI context has an unrecognized proto field (which should
never happen), free the context we allocated before returning EINVAL.

[ghudson@mit.edu: clarify commit message]
Fix unlikely memory error in krb5_rd_cred

If an error occurs in the for loop in krb5_rd_cred_basic (which should
only happen on an ENOMEM), do not leave the caller with a dangling
reference to the freed credential array.

ticket: 7908 (new)
target_version: 1.12.2
Allow GSS mechs to force mechlistMIC in SPNEGO

During a SPNEGO negotiation, if the NTLMSSP mechanism is used and a
MIC is produced within the final initiator mechanism token, Microsoft
servers require a mechlistMIC even if NTLMSSP was the most preferred
mechanism.

In spnego_mech.c, add a helper function mech_requires_mechlistMIC
which queries the mechanism to determine whether we might need to
produce a mechlistMIC for interoperability.  Call it after each call
to the mechanism's gss_init_sec_context and set sc->mic_reqd if it
returns true.  Although only the second call to NTLMSSP will actually
ever return true, the first call makes the mechanism aware that the
SPNEGO implementation supports this feature.

[ghudson@mit.edu: clarified commit message and code]

ticket: 7907 (new)
Unlocked db2 KDB iteration

Try to make an optional db2 iterator that unlocks (and therefore
closes) the KDB between iterations, to allow large KDBs to be dumped
without blocking writes for a long time.

This is a hackish proof of concept.  It won't work for all consumers
of db_iterate, especially ones that need to hold other locks while
iterating.