Add RBCD client support

Add RBCD client support

When making S4U2Proxy requests, include a PA-PAC-OPTIONS pa-data
element advertising resource-based constrained delegation support.  If
the KDC returns a referral TGT for the initial request and advertises
RBCD support, chase referrals to the target realm with both a regular
and proxy TGT, and make an S4U2Proxy request to the target realm with
the proxy TGT as evidence ticket.

Because cross-realm S4U2Proxy requests must use referrals, an explicit
foreign realm in the server name cannot be honored.  In the GSSAPI
krb5 mech, if a host-based server name is used, omit the realm (if one
was obtained from [domain_realm] or similar) when calling
krb5_get_credentials() for constrained delegation.

[ghudson@mit.edu: rewrote commit message; made style changes]

ticket: 8479