Refactor KDC option/flag processing

A lot of KDC code was spent copying options to flags, and copying
header_ticket flags to the output ticket.

Behavior change: previous code didn't copy PROXY from the
header_ticket, but this seems to have been a minor bug rather than
intentional.

People have looked at these code changes before; most of the changes since then are comments.