[krbdev.mit.edu #7465] minimum iteration count for PBKDF2

[Tom Yu via RT]

PBKDF2 for AES and similar enctypes should have a minimum iteration count.  It's not clear 
whether this needs to be a runtime configuration parameter, instead of a compile-time 
parameter.