kdc: add finalize_reply API to windc plugin

Allow a windc plugin to finalize the KDC reply (including the encrypted ticket
and reply parts) before encoding for transmission.

kdc/kerberos5.c

@@ -2745,6 +2745,13 @@ _kdc_as_rep(astgs_request_t r)
 	}
     }
 
+    /*
+     * Last chance for plugins to update reply
+     */
+    ret = _kdc_finalize_reply(r);
+    if (ret)
+	goto out;
+
     /*
      * Don't send kvno from client entry if the pre-authentication
      * mechanism replaced the reply key.