auth/spnego: split gensec_spnego_create_negTokenInit() into subfunctions