Fix LDAP policy enforcement of pw_expiration

Fix LDAP policy enforcement of pw_expiration

In the LDAP backend, the change mask is used to determine what LDAP
attributes to update.  As a result, password expiration was not set
from policy when running during addprinc, among other issues.
However, when the mask did not contain KADM5_PRINCIPAL, pw_expiration
would be applied regardless, which meant that (for instance) changing
the password would cause the password application to be applied.

Remove the check for KADM5_PRINCIPAL, and fix the mask to contain
KADM5_PW_EXPIRATION where appropriate.  Add a regression test to
t_kdb.py.

[ghudson@mit.edu: also set KADM5_ATTRIBUTES for randkey and setkey
since they both unset KRB5_KDB_REQUIRES_PWCHANGE; edited comments and
commit message]

ticket: 8861 (new)
tags: pullup
target_version: 1.17-next