Add dns_canonicalize_hostname=fallback support

Add dns_canonicalize_hostname=fallback support

Turn dns_canonicalize_hostname into a tristate variable, allowing the
value "fallback" as well as the true/false booleans.  If it is set to
fallback, delay DNS canonicalization and attempt it only in
krb5_get_credentials() if the KDC responds that the requested server
principal name is unknown.

[ghudson@mit.edu: added TGS tests; refactored code; edited commit
message and documentation]

ticket: 8765 (new)