Fix enctype selection issues for PAC and other authz-data signatures
Fix enctype selection issues for PAC and other authz-data signatures

    We were using the enctype from the PA-TGS-REQ's AP-REQ's Ticket to
    decide what key from the service's realm's krbtgt principal to use.
    This breaks when: a) we're doing cross-realm, b) the service's
    realm's krbtgt principal doesn't have keys for the enctype used in
    the cross-realm TGT.

    The fix is to pick the correct key (strongest or first, per-config)
    from the service's realm's krbtgt principal.

madscientist159/heimdal,madscientist159/heimdal,madscientist159/heimdal,madscientist159/heimdal,madscientist159/heimdal,madscientist159/heimdal,madscientist159/heimdal