spnego SPN fix when contacting trusted domains

spnego SPN fix when contacting trusted domains

cli_session_setup_spnego() was not taking into consideration the situation
where we're connecting to a trusted domain, specifically one (like W2K8)
which doesn't return a SPN in the NegTokenInit.

This caused two problems:

1) When guessing the SPN using kerberos_get_default_realm_from_ccache() we
were always using our default realm, not the realm of the domain we're
connecting to.

2) When falling back on NTLMSSP for authentication we were passing the name
of the domain we're connecting to for use in our credentials when we should be
passing our own workgroup name.

The fix for both was to split the single "domain" parameter into
"user_domain" and "dest_realm" parameters.  We use the "user_domain"
parameter to pass into the NTLM call, and we used "dest_realm" to create an SPN
if none was returned in the NegTokenInit2 packet.  If no "dest_realm" is
provided we assume we're connecting to our own domain and use the credentials
cache to build the SPN.

Since we have a reasonable guess at the SPN, I removed the check that defaults
us directly to NTLM when negHint is empty.