auth/spnego: make sure we don't return OK without sub_sec_ready in gensec_spnego_clie...