s3:libads: let ads_sasl_spnego_bind() really use spnego to negotiate krb5/ntlmssp

s3:libads: let ads_sasl_spnego_bind() really use spnego to negotiate krb5/ntlmssp

For now we still do the ads_kinit_password() in ads_legacy_creds()
for callers that rely on the global krb5ccache to be filled.

E.g. the dns update code and the kpasswd code.

But at least ads_connect_internal() and ads_sasl_spnego_bind()
will allow to do the kinit in the gensec layer only if needed...

We'll remove ads_legacy_creds() during the following commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>