auth/kerberos: Create common helper to get the verified PAC from GSSAPI