this patch add the possibility to validate the credentials obtained from
a Kerberos server with a local keytab. The boolean option krb5_validate
switches the validation on and off. It is disabled by default in the
kerberos provider and enabled by default in the IPA provider.
Typically root privileges are needed to read a keytab. As a consequence
if validation is enabled the privileges cannot be drop before starting
krb5_child, but only after reading the keytab.