Improve PKINIT UPN SAN matching

Improve PKINIT UPN SAN matching

Add the match_client() kdcpreauth callback and use it in
verify_client_san().  match_client() preserves the direct UPN to
request principal comparison and adds a direct comparison to the
client principal, falling back to an alias DB search and comparison
against the client principal.  Change crypto_retreive_X509_sans() to
parse UPN values as enterprise principals.

[ghudson@mit.edu: use match_client for both kinds of SANs]

ticket: 8528 (new)