auth/spnego: split out a gensec_spnego_client_negTokenTarg() function