Add KDC policy pluggable interface

Add KDC policy pluggable interface

Add the header include/krb5/kdcpolicy_plugin.h, defining a pluggable
interface for modules to deny AS and TGS requests and set maximum
ticket lifetimes.  This interface replaces the policy.c stub functions.

Add check_kdcpolicy_as() and check_kdcpolicy_tgs() as entry functions.
Call them after auth indicators and ticket lifetimes have been
determined.

Add a test module and a test script with basic kdcpolicy tests.  Add
plugin interface documentation in doc/plugindev/policy.rst.

Also authored by Matt Rogers <mrogers@redhat.com>.

ticket: 8606 (new)