Fix t_marshal on big-endian platforms

t_marshal.c attempts to skip the version 1 and 2 tests on big-endian
platforms, but didn't do so correctly.  Correctly start at version 3
on big-endian platforms, and change the way we do it to avoid
preprocessor conditionals inside a function body.
Fix invalid JSON handling in KDC OTP module

If the OTP configuration for a principal contains invalid JSON, the
KDC OTP module calls k5_json_get_tid on a null pointer, causing the
KDC process to crash.  Fix this bug by checking the return value of
k5_json_decode in decode_config_json.

ticket: 7912 (new)
target_version: 1.12.2
tags: pullup
Use case insensitive DNS SAN matching in PKINIT

Matching Subject Alternative Name from certificate with
pkinit_kdc_hostname value from krb5.conf should disregard case.

ticket: 7913 (new)