s4-kdc_kpasswd: split out some code to a KPASSWD_GLUE subsystem.