auth/spnego: split gensec_spnego_client_negTokenInit() into subfunctions