Add PAC ticket signature APIs

Add PAC ticket signature APIs

Microsoft added a third PAC signature over the ticket to prevent
servers from setting the forwardable flag on evidence tickets.  Add
new APIs to generate and verify ticket signatures, as well as defines
for this and other new PAC buffer types.  Deprecate the old signing
functions as they cannot generate ticket signatures.  Modify several
error returns to better match the protocol errors generated by Active
Directory.

[ghudson@mit.edu: adjusted contracts for KDC requirements; simplified
and commented code changes; wrote commit message.  rharwood@redhat.com
also did some work on this commit.]

ticket: 9043 (new)