Change definition of KRB5_KDB_FLAG_CROSS_REALM

Change definition of KRB5_KDB_FLAG_CROSS_REALM

Set the CROSS_REALM flag if the header ticket was issued by a
different realm, instead of when the client is part of a different
realm.  The affected corner cases are:

* In the final request of a cross-realm S4U2Self request, the header
  ticket client is local but the header ticket was issued by a
  different realm.  The CROSS_REALM flag will now be set in this case.

* If a foreign client renews or validates a locally issued ticket, the
  CROSS_REALM flag will no longer be set.

* If a foreign client requests a local TGT and then uses it to make a
  request, the CROSS_REALM flag will no longer be set.

Also add a new flag KRB5_KDB_FLAG_ISSUING_REFERRAL, which is set when
the KDC decides to issue a referral or alternate TGT.  Use the new
flag meanings to simplify S4U2Self processing.

[ghudson@mit.edu: edited comments and commit messages]

ticket: 8827 (new)