Implement KERB_AP_OPTIONS_CBT (server side)

if the client asserted knowledge of channel-bindings by
passing KERB_AP_OPTIONS_CBT, and the server passed bindings,
require the bindings to match.

lib/krb5/version-script.map

@@ -780,6 +780,7 @@ HEIMDAL_KRB5_2.0 {
 		_krb5_kt_client_default_name;
 		_krb5_have_debug;
 		_krb5_SP800_108_HMAC_KDF;
+		_krb5_get_ad;
 
 		# Shared with libkadm5
 		_krb5_load_plugins;