Implement fallback for GSS acceptor names

Implement fallback for GSS acceptor names

Commit 3fcc365a6f049730b3f47168f7112c03997c5c0b added fallback support
to krb5_rd_req(), but acquiring acceptor creds for a host-based name
could still fail within check_keytab() in the krb5 mech.

Add an internal libkrb5 API k5_kt_have_match() to check for a matching
keytab entry with canonicalization, and use it in check_keytab().  Add
a library-internal function k5_sname_wildcard_host() to share logic
between rd_req and k5_kt_have_match().

ticket: 8971 (new)
tags: pullup
target_version: 1.19