Add initiator-side IAKERB realm discovery

Add initiator-side IAKERB realm discovery

When importing a name to IAKERB, don't add the default realm when we
parse strings.  Host-based name imports will continue to use
krb5_sname_to_principal(), which may add a realm from [domain_realm]
but won't add the default realm.

In the IAKERB state machine, query for the service's realm if the
client name doesn't have a realm.  To reduce code duplication, make
iakerb_make_token() responsible for saving the token and incrementing
the message count.

[ghudson@mit.edu: added tests; added a discovery state to the machine;
expanded import; adjusted iakerb_make_token() contract; rewrote commit
message]

ticket: 9167 (new)