Correctly get default realm in kdb5.c

Call krb5_get_default_realm instead of directly accessing
context->default_realm, to remove the requirement that
krb5_get_default_realm or krb5_set_default_realm be used before
krb5_db_open.
Fix SAM-2 preauth when password argument is used

sam2_process accesses gak_data to get the password, so that it can do
string-to-key with the etype in the SAM-2 challenge.  When #7642
changed gic_pwd.c to use struct gak_password instead of krb5_data,
sam2_process wasn't altered to match.  We don't see a problem when the
password is read through the prompter (as with kinit), because the
password winds up in the storage field at the beginning of the
gak_password structure.  But when a password is supplied as a
parameter (as with ksu), the storage field is empty and we get the
wrong answer from sam2_process.

ticket: 7862
target_version: 1.12.2
tags: pullup
Don't use system dictionary files for DB2 tests

The system dictionary may contain entries with punctuation, which can
confuse the shell.  It's more predictable to always use the word list
from the source tree.

ticket: 7860
status: open
Portable transport enumerator
Build support for HTTPS transport
Remaining cm read/write mutator functions
Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGE
Dispatch-style protocol switching for transport
HTTPS transport (Microsoft KKDCPP implementation)
Be more exacting about the reply content-length
Remove a check on the kpasswd server's address

This test breaks when we're sending password changes over HTTP, and most
likely under NAT, too.
Track the realm name for MS-KKDCP

Always pass a realm name to set_conn_state_msg_length(), to ensure that
we include the not-actually-optional target-domain field if we're using
MS-KKDCP.
Don't try to zero the byte after the buffer
Add http_anchors and http_revoke settings

Add http_anchors and http_revoke settings, mimicking both the locations
and effects of their similarly-named PKINIT counterparts, but affecting
HTTPS connections to KDC proxy servers.
Add an http_hostname option

Add an http_hostname option, though for now it only specifies alternate
CN values that we'd accept in the server's certificate's subject name
field.
Support dnsName subjectAltName hostname matching

Parse subjectAltName extensions when checking for a hostname match,
which also requires that we accept certificates without subject names.
Mention that MS-KKDCP also encrypts names
Differentiate HTTPS and TCP trace messages
Add certificates for a testing MS-KKDCP proxy
Add a simple KDC proxy test server

This proxy server uses python-paste to run the kdcproxy from
https://pypi.python.org/pypi/kdcproxy.  It should be used along
with the proxy.pem certificate in ../tests/dejagnu/proxy-certs.