Limit -keepold for self-service key changes

Limit -keepold for self-service key changes

In libkadm5, change the type of the keepold parameters from
krb5_boolean to unsigned int (which is the underlying type of
krb5_boolean, so this is not an API or ABI change).  In libkadm5srv,
interpret a keepold value greater than 2 to be a limit on the number
of resulting key versions including the new one.

In kadmind, when a principal changes its own keys, limit the number of
resulting key versions to 5.

ticket: 9173 (new)