Use the new authtok abstraction and interfaces throught the code.

This set of functions enumerate the user's groups and invalidate them all
if the list does not matches what we get from the caller.

This set of functions enumerate each user/group from all domains
and invalidate any mmap cache record that matches.

Avoids hardcoding magic numbers everywhere and self documents why a
mask is being applied.

In general Kerberos is case sensitive but the KDC of Active Directory
typically handles request case in-sensitive. In the case where we guess
a user principal by combining the user name and the realm and are not
sure about the cases of the letters used in the user name we might get a
valid ticket from the AD KDC but are not able to access it with the
Kerberos client library because we assume a wrong case.

The client principal in the returned credentials will always have the
right cases. To be able to update the cache user principal name the
krb5_child will return the principal for further processing.