krb5: import Heimdal-597.121.1 AS/TGS client

Sync with most changes in AS/TGS client from Apple's Heimdal-597.121.1
(opensource.apple.com).

Changes include:

 - FAST support in TGS client
 - Refactored pre-auth client to be more easily extensible
 - Pin KDC host and AD site name in API calls

Note the completely refactored TGS client loop is not imported as that was
considered too intrusive.

README.fast

@@ -1,9 +1,6 @@
 
 -- in order of preference
 
-- client: support KRB5_PADATA_ENCRYPTED_CHALLENGE in lib/krb5/init_creds_pw.c
-- client: don't support ENC-TS in FAST
-
 - client: plugin support for fast plugins
 
 - kdc: plugin support for fast plugins
@@ -13,5 +10,3 @@
 -- using PK-INIT anonymous
 -- using host key
 
-- client: tgs-req fast support
-- kdc: tgs-req fast support