Use zapfree in krb5_decrypt_tkt_part

ticket: 7982 (new)
target_version: 1.12.2
tags: pullup
In ksu, without the -e flag, also check .k5users

When ksu was explicitly told to spawn a shell, a line in .k5users which
listed "*" as the allowed command would cause the principal named on the
line to be considered as a candidate for authentication.

When ksu was not passed a command to run, which implicitly meant that
the invoking user wanted to run the target user's login shell, knowledge
that the principal was a valid candidate was ignored, which could cause
a less optimal choice of the default target principal.

This doesn't impact the authorization checks which we perform later.

ticket: 7983 (new)
Fix the build on windows

Windows does not provide the glob() functionality used to implement
the /etc/gss/mechs.d/ feature, so we must avoid compiling the
relevant code for windows.  (It would never have been called, anyway.)

Adjust the ccache/Makefile.in rules to not use '-' or '@' in
make variable names that are processed by nmake.

Also in ccache/Makefile.in, remove some latent leading whitespace that
had been previously hidden by the previous rule; this exposed some
flawed dependencies that are now removed.

Windows does not provide sys/socket.h or sys/un.h, so don't try
to include them in cc_kcm.c.

The commit which moved the KKDCP TLS support to a plugin left some
dangling references to checkhost.c byproducts in os/Makefile.in,
which can be safely removed.

Use k5-platform.h in support/json.c instead of a set of system includes;
this lets windows build the static inline helper functions therein.