Limit use of deprecated krb5 mech OIDs

Limit use of deprecated krb5 mech OIDs

Filter out mechs with the GSS_C_MA_DEPRECATED attribute from the set
of mechanisms obtained by SPNEGO, and from the set used when
gss_acquire_cred() is called with no desired_mechs attribute.

SPNEGO acceptors will still accept the old and wrong krb5 OIDs, but
SPNEGO initiators will not offer them.  According to [MS-SPNG], only
Windows 2000 does not recognize the standard krb5 OID, and it is
client-only.

In gss-client.c, use the standard krb5 OID for the -krb5 option, as
acceptors who call gss_acquire_cred() with no desired_mechs to create
an acceptor cred will no longer accept the old or wrong krb5 OIDs.

ticket: 8217 (new)