Make KRB5SignedPath less fragile, only sign trivial parts of the encTicketPart

Sign the client and auth time (like its done in the PAC) and let that
be ehough for now. Add a Typed hole so that we don't break wireprotocol
next time.

kdc/kerberos5.c

@@ -1747,6 +1747,7 @@ _kdc_as_rep(krb5_context context,
 				  config,
 				  server,
 				  setype,
+				  client->entry.principal,
 				  NULL,
 				  NULL,
 				  &et);