back-port r19748 from trunk

 Based on Apple's patch, during the referrals loop, check to see if the
 session key enctype of a returned credential for the final service is
 among the enctypes explicitly selected by the application, and retry
 with old_use_conf_ktypes if it is not.


Commit By: tlyu



Revision: 19751
Changed Files:
_U  branches/krb5-1-6/
U   branches/krb5-1-6/src/lib/krb5/krb/gc_frm_kdc.c