krb5_wrap: fix keep_old_entries logic for older kerberos libraries