auth/spnego: do basic state_position checking in gensec_spnego_update_in()