s4-kdc: Add a new kpasswd service implementation