Defer primary KDC lookups

Defer primary KDC lookups

Add an internal variant of krb5_sendto_kdc() which records the
answering KDC in a list.  Callers can check the list for replica KDC
use after the success or failure of the KDC exchange is determined,
avoiding DNS queries for the primary KDCs in many common cases and
using fewer DNS queries in other cases.

Perform the fallback in k5_get_init_creds() rather than
krb5_get_init_creds_password().  For now we must additionally perform
the fallback in krb5_get_init_creds_keytab() as it does not use
k5_get_init_creds().

Preserve the current signature of krb5_sendto_kdc() (it is used within
the tree outside of libkrb5, and might be used by other software
despite being non-public), but remove the behavior of setting
*use_primary.

ticket: 7721