[krbdev.mit.edu #6210] pa_sam leaks parts of krb5_sam_challenge

[Alexandra Ellwood via RT]

pa_sam (preauth2.c) calls decode_krb5_sam_challenge and then just calls krb5_xfree to free the 
resulting krb5_sam_challenge.  However, krb5_sam_challenge is a deep structure.

Should be calling krb5_free_sam_challenge instead.