Restrict pre-authentication fallback cases

Restrict pre-authentication fallback cases

Add a new callback disable_fallback() and call it from each clpreauth
module when it generates a client message using credentials to
authenticate.  (For SPAKE, this is the message responding to a
challenge; for all other current mechanisms, it is the first and only
client message.)  If disable_fallback() is called, do not try another
mechanism after a KDC error.

Remove k5_reset_preauth_types_tried() and its call sites, so that
preauth mechanisms which are tried optimistically will no longer be
retried after a failure.

ticket: 8654