Fix transit path validation

Also implement KDC hierarchical transit policy checks.  The "hier_capaths"
parameter defaults to "yes" in [libdefaults] or can be set explicitly in
[realms] per-realm.

lib/krb5/version-script.map

@@ -784,6 +784,10 @@ HEIMDAL_KRB5_2.0 {
 		_krb5_fast_cf2;
 		_krb5_fast_armor_key;
 
+                # TGS
+                _krb5_find_capath;
+                _krb5_free_capath;
+
 	local:
 		*;
 };