s4-kdc: Switch to the new kpasswd service implementation