Implement fallback for GSS acceptor names

Implement fallback for GSS acceptor names

Commit 3fcc365a6f049730b3f47168f7112c03997c5c0b added fallback support
to krb5_rd_req(), but acquiring acceptor creds for a host-based name
could still fail within check_keytab() in the krb5 mech.

Add an internal libkrb5 API k5_kt_have_match() to check for a matching
keytab entry with canonicalization, and use it in check_keytab().  Add
a library-internal function k5_sname_wildcard_host() to share logic
between rd_req and k5_kt_have_match().

(cherry picked from commit 7e0a2a7a3a76205ebd7192f06a99f23bad8dc5bd)

ticket: 8971
version_fixed: 1.19