Be stricter about ASN.1 decoding

Be stricter about ASN.1 decoding

Remove support for BER indefinite-length encodings, which are not
valid in DER.  Enforce validity of digits in GeneralizedTime values.
Reject signed integer encodings large enough to possibly overflow
intmax_t, and use regular arithmetic to avoid the undefined behavior
of left-shifting a negative integer.  Reject trailing garbage in
explicitly-tagged single values.  Remove the unnecessary
KRB5_GENEROUS_LR_TYPE workaround; our KDC doesn't generate last-req
information, so the broken pre-2000 encoding behavior had no impact.

[ghudson@mit.edu: edited commit message]