Refactor GSS per-message token parsing

Refactor GSS per-message token parsing

Replace kg_unseal_v1() and gss_krb5int_unseal_token_v3() with new
functions using current coding practices.  Notable differences
include:

* The new functions use k5input for improved safety.
* The new functions do not modify the input buffer.
* The new functions will never try to allocate zero bytes of memory.
* There are separate functions for unwrap and verify_mic, which means
  there is no message_buffer parameter acting conditionally as an
  input or output.