s4-kdc: Move kpasswd_make_error_reply() to a helper file