Fix t_marshal on big-endian platforms

t_marshal.c attempts to skip the version 1 and 2 tests on big-endian
platforms, but didn't do so correctly.  Correctly start at version 3
on big-endian platforms, and change the way we do it to avoid
preprocessor conditionals inside a function body.
Fix invalid JSON handling in KDC OTP module

If the OTP configuration for a principal contains invalid JSON, the
KDC OTP module calls k5_json_get_tid on a null pointer, causing the
KDC process to crash.  Fix this bug by checking the return value of
k5_json_decode in decode_config_json.

ticket: 7912 (new)
target_version: 1.12.2
tags: pullup
Use case insensitive DNS SAN matching in PKINIT

Matching Subject Alternative Name from certificate with
pkinit_kdc_hostname value from krb5.conf should disregard case.

ticket: 7913 (new)
Unlocked db2 KDB iteration

Try to make an optional db2 iterator that unlocks (and therefore
closes) the KDB between iterations, to allow large KDBs to be dumped
without blocking writes for a long time.

This is a hackish proof of concept.  It won't work for all consumers
of db_iterate, especially ones that need to hold other locks while
iterating.