Change KDC constrained-delegation precedence order

Change KDC constrained-delegation precedence order

MS-SFU errata from 2019/12/09 indicates that legacy constrained
delegation should be prefered over resource-based constrained
delegation, which results slight diferences.

Also clarify that in the get_authdata_info KDB method, the PAC must be
verified and checked for user sensitivity for S4U2Proxy.  Document
that the client name should only be provided in the cross-realm
S4U2Proxy case.

[ghudson@mit.edu: clarified comments and commit message]

ticket: 8884 (new)
tags: pullup
target_version: 1.18-next