Re-encrypt preserved key data in new master key

When we are preserving old key data in kdb_cpw.c, ensure that it is
encrypted with the same master key as the new key data.  This ensures
that the KRB5_TL_MKVNO tl-data on the principal entry applies to all
of the key data, not just some of it.

ticket: 7995
target_version: 1.13
tags: pullup
Add test case for -keepold mkey re-encryption

ticket: 7995
Simplify kdb_cpw.c

In add_key_rnd, stop looking up the krbtgt DB entry; we have not used
it since 1.1.

Use copy_key_data in add_key_rnd and add_key_pwd.

krb5_dbe_crk, krb5_dbe_ark, krb5_dbe_def_cpw, and krb5_dbe_apw all
contained similar logic.  Consolidate all of them into a static helper
function which does the work of all four.  The ark/apw variants had
slightly different behavior then crk/cpw with keepold=true, so
introduce a three-value enum to express all three behaviors.