Adjust processing of pa_type ccache config

Adjust processing of pa_type ccache config

Read the allowed preauth type from the input ccache in
restart_init_creds_loop(); there is no need to reread it each time we
produce a request.  Move read_allowed_preauth_type() earlier in the
file to allow it to be called from restart_init_creds_loop() without a
prototype.

Clear the selected preauth type in restart_init_creds_loop(), not in
init_creds_step_request().  We want to make sure that it doesn't
survive a restart due to a realm referral or expiry, but we don't want
to forget about it when retrying after an error.