identity: add some locking around expiration time

We don't want the expiration time to get read while it's getting
written.

https://bugzilla.gnome.org/show_bug.cgi?id=739593
identity: don't set expiration_time to 0 intermediately while verifying identity

The top of verify_identity calls

set_expiration_time(self, 0);

as a way to make sure the expiration time is 0'd if the identity's
credentials are invalidated.  In the case, they are still valid,
set_expiration_time is called again with the new, most up to date
value. The problem is the intermediate 0 isn't invisible, there's a
window where the identity can be read and 0 will get returned, even
when the identity is valid.

This commit defers setting the expiration time until the very end of
the function.

https://bugzilla.gnome.org/show_bug.cgi?id=739593
kerberos: fail inquiry if provided buffer is too small for password

Right now we just truncate the user's response if it's too big for
the passed in buffer.  That's wrong on a theoretical level; we
shouldn't ever use a password that the user didn't enter
(even if it's a truncated version of what the user did enter).
In practice, it's not actually a problem. The kerberos library provides
a full 1024 byte buffer, which is much longer than a user would
realistically enter into an entry.

Still, this commit addresses the problem by introducing a mechanism for
failing the inquiry.

https://bugzilla.gnome.org/show_bug.cgi?id=739593