s4:kdc: add a kdc_proxy_unavailable_error() helper function