[krbdev.mit.edu #7709] Wrong order in kdc_check_transited_list()

[Greg Hudson via RT]

I have a patch in review for this and expect to push it later today.

This will be a semantic change to check_transited_realms; a module will 
have to return KRB5_PLUGIN_NO_HANDLE to invoke the core transited-
checking rules instead of just returning 0.  I think that's okay since 
the KDB interface is still private and the check_transited_realms method 
is still pretty obscure within that interface.