[krbdev.mit.edu #8547] Allow client principal canonicalization for non-TGT AS requests

[Greg Hudson via RT]

get_in_tkt.c:verify_as_reply() allows changes to the client and server 
principals in the reply under certain conditions.  We only allow changes 
to the server principal if the requested and received server principal 
are krbtgt principals, in order to mitigate some of the attacks 
described in the security considerations of RFC 6806.  However, we also 
disallow changes to the client principal for non-krbtgt requests, which 
does not seem to have any rationale.  See:

http://mailman.mit.edu/pipermail/krbdev/2017-February/012721.html