s4-kdc Rework 'allowed encryption types' handling in the KDC