hdb: Move virtual principals into HDB layer

This is a large commit that adds several features:

 - Revamps and moves virtual host-based service principal functionality
   from kdc/ to lib/hdb/ so that it may be automatically visible to
   lib/kadm5/, as well as kadmin(1)/kadmind(8) and ktutil(1).

   The changes are backwards-incompatible.

 - Completes support for documenting a service principal's supported
   enctypes in its HDB entry independently of its long-term keys.  This
   will reduce HDB bloat by not requiring that service principals have
   more long-term keys than they need just to document the service's
   supported enctypes.

 - Adds support for storing krb5.conf content in principals' HDB
   entries.  This may eventually be used for causing Heimdal KDC
   services to reconfigure primary/secondary roles automatically by
   discovering the configured primary in an HDB entry for the realm.

   For now this will be used to help reduce the amount of configuration
   needed by clients of an upcoming HTTP binding of the kadmin service.

kadmin/kadmin-commands.in

@@ -215,6 +215,128 @@ command = {
 	min_args = "1"
 	help = "Adds a principal to the database."
 }
+command = {
+	name = "add_namespace"
+	name = "add_ns"
+	function = "add_new_namespace"
+	option = {
+		long = "enctypes"
+		short = "e"
+		type = "string"
+		help = "encryption type(s)"
+	}
+	option = {
+		long = "max-ticket-life"
+		type = "string"
+		argument ="lifetime"
+		help = "max ticket lifetime"
+	}
+	option = {
+		long = "max-renewable-life"
+		type = "string"
+		argument = "lifetime"
+		help = "max renewable life"
+	}
+	option = {
+		long = "key-rotation-epoch"
+		type = "string"
+		argument = "time"
+		help = "absolute start time (or +timespec for relative to now with default unit of month)"
+	}
+	option = {
+		long = "key-rotation-period"
+		type = "string"
+		argument = "time"
+		help = "automatic key rotation period"
+	}
+	option = {
+		long = "attributes"
+		type = "string"
+		argument = "attributes"
+		help = "principal attributes"
+	}
+	argument = "principal..."
+	min_args = "1"
+	help = "Adds a namespace of virtual principals with derived keys to the database."
+}
+command = {
+	name = "modify_namespace"
+	name = "mod_ns"
+	function = "modify_namespace"
+	option = {
+		long = "enctypes"
+		short = "e"
+		type = "strings"
+		help = "encryption type(s)"
+	}
+	option = {
+		long = "max-ticket-life"
+		type = "string"
+		argument ="lifetime"
+		help = "max ticket lifetime"
+	}
+	option = {
+		long = "max-renewable-life"
+		type = "string"
+		argument = "lifetime"
+		help = "max renewable life"
+	}
+	option = {
+		long = "attributes"
+		type = "string"
+		argument = "attributes"
+		help = "principal attributes"
+	}
+	option = {
+		long = "krb5-config-file"
+		short = "C"
+		type = "string"
+		help = "filename to save the principal's krb5.confg in"
+	}
+	argument = "principal..."
+	min_args = "1"
+	help = "Modifies a namespace of virtual principals with derived keys to the database."
+}
+command = {
+	name = "modify_namespace_key_rotation"
+	name = "mod_ns_kr"
+	function = "modify_ns_kr"
+	option = {
+		long = "force"
+		short = "f"
+		type = "flag"
+		help = "change schedule even if it would revoke some extant tickets"
+	}
+	option = {
+		long = "keep-base-key"
+		short = "k"
+		type = "flag"
+		help = "keep current base key for new key rotation schedule"
+	}
+	option = {
+		long = "revoke-old"
+		short = "r"
+		type = "string"
+		argument = "time"
+		help = "delete base keys older than this to revoke old tickets"
+	}
+	option = {
+		long = "new-key-rotation-epoch"
+		type = "string"
+		argument = "time"
+		help = "new start time relative to now"
+	}
+	option = {
+		long = "new-key-rotation-period"
+		type = "string"
+		argument = "time"
+		help = "new automatic key rotation period"
+	}
+	argument = "principal..."
+	min_args = "1"
+	max_args = "1"
+	help = "Adds or changes new key rotation schedule for the given namespace."
+}
 command = {
 	name = "passwd"
 	name = "cpw"
@@ -276,6 +398,14 @@ command = {
 	min_args = "1"
 	help = "Deletes all principals matching the expressions."
 }
+command = {
+	name = "delete_namespace"
+	name = "del_ns"
+	function = "del_namespace"
+	argument = "principal..."
+	min_args = "1"
+	help = "Deletes the given virtual principal namespaces"
+}
 command = {
 	name = "del_enctype"
 	argument = "principal enctype..."
@@ -364,6 +494,12 @@ command = {
 		type = "string"
 		help = "columns to print for short output"
 	}
+	option = {
+		long = "krb5-config-file"
+		short = "C"
+		type = "string"
+		help = "filename to save the principal's krb5.confg in"
+	}
 	argument = "principal..."
 	min_args = "1"
 	help = "Shows information about principals matching the expressions."
@@ -378,6 +514,7 @@ command = {
 }
 command = {
 	name = "modify"
+	name = "mod"
 	function = "mod_entry"
 	option = {
 		long = "max-ticket-life"
@@ -440,6 +577,13 @@ command = {
 		argument = "policy"
 		help = "policy name"
 	}
+	option = {
+		long = "service-enctypes"
+                short = "e"
+		type = "strings"
+		argument = "enctype"
+		help = "set enctypes supported by service"
+	}
 	option = {
 		long = "hist-kvno-diff-clnt"
 		type = "integer"
@@ -454,6 +598,12 @@ command = {
 		help = "historic keys allowed for service"
 		default = "-1"
 	}
+	option = {
+		long = "krb5-config-file"
+		short = "C"
+		type = "string"
+		help = "krb5.conf to save in principal record"
+	}
 	argument = "principal"
 	min_args = "1"
 	max_args = "1"
@@ -507,6 +657,10 @@ command = {
 		type = "string"
 		help = "columns to print for short output"
 	}
+	option = {
+		long = "krb5-config-file"
+		type = "string"
+	}
 	argument = "principal..."
 	min_args = "1"
 	help = "Lists principals in a terse format. Equivalent to \"get -t\"."