krb5: Improve cccol sub naming; add gss_store_cred_into2()

- Formalize the TYPE:collection_name:subsidiary_name naming scheme for
   ccaches in ccache collections
    - KEYRING: ccaches are weird because they have one more optional field: the
      "anchor", so rather than just assume a naming convention everywhere, we
      add new functions as well
 - Add krb5_cc_{resolve,default}_sub() that allows one to specify a
   "subsidiary" ccache name in a collection separately from the
   collection name
 - Add krb5_cc_{resolve,default}_for() which take a principal name,
   unparse it, and use it as the subsidiary ccache name (with colons
   replaced)
 - Make kinit use the new interfaces
 - Add missing DIR ccache iteration functionality
 - Revamps test_cc
 - Add krb5_cc_get_collection() and krb5_cc_get_subsidiary()
 - Bump the ccops SPI version number
 - Add gss_store_cred_into2()
 - Make MEMORY:anonymous not linked into the global MEMORY ccache
   collection, and uses this for delegated cred handles

TBD:

 - Split this up into a krb5 change and gss mech_krb5 change?
 - Add krb5_cc_init_and_store() utility, per Greg's suggestion?

lib/gssapi/krb5/accept_sec_context.c

@@ -169,8 +169,7 @@ gsskrb5_accept_delegated_token
     }
 
     *delegated_cred_handle = NULL;
-    kret = krb5_cc_new_unique (context, krb5_cc_type_memory,
-                               NULL, &ccache);
+    kret = krb5_cc_resolve(context, "MEMORY:anonymous", &ccache);
     if (kret) {
 	ctx->flags &= ~GSS_C_DELEG_FLAG;
 	goto out;
@@ -204,7 +203,7 @@ gsskrb5_accept_delegated_token
 	gsskrb5_cred handle;
 
 	ret = _gsskrb5_krb5_import_cred(minor_status,
-					ccache,
+					&ccache,
 					NULL,
 					NULL,
 					delegated_cred_handle);
@@ -212,10 +211,7 @@ gsskrb5_accept_delegated_token
 	    goto out;
 
 	handle = (gsskrb5_cred) *delegated_cred_handle;
-
 	handle->cred_flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
-	krb5_cc_close(context, ccache);
-	ccache = NULL;
     }
 
 out: