add GSSAPI (Kerberos) authentication

[grawity]

This mechanism doesn't use a password. The supplied username is also ignored, although it could be sent as the SASL "authzid".

Patch was originally written for 20170101.0, so I might have missed some changes when porting it, but everything seems to still work.