Fix AS-REQ checking of KDB-modified indicators

Fix AS-REQ checking of KDB-modified indicators

Commit 7196c03f18f14695abeb5ae4923004469b172f0f (ticket 8823) gave the
KDB the ability to modify auth indicators, but it happens after the
asserted indicators are checked against the server principal
requirements.  In finish_process_as_req(), move the call to
check_indicators() after the call to handle_authdata() so that the
final indicator list is checked.

For the test case, add string attribute functionality to the test KDB
module, and fix a bug where test_get_principal() would return failure
if a principal has no keys.  Also add a test case for AS-REQ
enforcement of normally asserted auth indicators.

ticket: 8876 (new)
tags: pullup
target_version: 1.18-next