Rewrite gss_add_cred() (fix #413)

It turns out gss_add_cred() really needed a complete rewrite.  It's much
better to first have a gss_duplicate_cred() (which has been needed for
other reasons anyways), and use that when the input_cred_handle is not
GSS_C_NO_CREDENTIAL and output_cred_handle is not NULL, then mutate that
duplicate credential handle (or the input_cred_handle if
output_cred_handle is NULL).

lib/gssapi/ntlm/ntlm.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006-2018 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -105,6 +105,7 @@ typedef struct ntlm_cred {
     char *domain;
     struct ntlm_buf key;
 } *ntlm_cred;
+typedef const struct ntlm_cred *ntlm_const_cred;
 
 typedef struct {
     struct ntlm_server_interface *server;