kdc: add finalize_reply API to windc plugin

Allow a windc plugin to finalize the KDC reply (including the encrypted ticket
and reply parts) before encoding for transmission.

kdc/krb5tgs.c

@@ -841,6 +841,10 @@ tgs_make_reply(astgs_request_t r,
 	}
     }
 
+    ret = _kdc_finalize_reply(r);
+    if (ret)
+	goto out;
+
     /* It is somewhat unclear where the etype in the following
        encryption should come from. What we have is a session
        key in the passed tgt, and a list of preferred etypes