s4-kdc: move kdc_check_pac() to a new subsystem KDC-GLUE.