NMS-9350: Add support for Kerberos message encryption

[dino2gnt]

Adds support for Kerberos message encryption, as detailed in https://msdn.microsoft.com/en-us/library/ee896923.aspx and https://msdn.microsoft.com/en-us/library/cc251574.aspx

This was completed a couple months ago and has been sat on since, so it is not fresh in my head how all this works.

This library is also in a weird half-Jakarta state and could stand some attention once this is merged, before a new release is cut.

[marshallmassengill]

Couple things that seem like blockers (via claude though I've also looked as much as I can and I think these are all valid).

KerberosDecryptInInterceptor.handleMessage returns early when the body doesn't start with --Encrypted Boundary, so a plaintext SOAP response is accepted.

Also, neither wrap nor unwrap inspects the MessageProp afterwards: getPrivacy() is never checked, so an integrity-only token is accepted as confidential in both directions, and isDuplicateToken/isOldToken/isUnseqToken/isGapToken are discarded, throwing away GSS replay detection. With withKerberosEncryption() on, a non-multipart or non-private response has to be a hard failure.

One GSSContextManager per operation, with correctness resting on a JVM-global socket pool. getIdentifier/getEnumerator/getTransferer each call createProxyFor, which constructs a fresh manager, so every identify/enumerate/pull/get runs its own full AP-REQ/AP-REP pre-flight. The encrypted POST then has to land on the exact TCP connection that that manager's handshake bound, but the HttpURLConnection keep-alive pool is keyed only by (host, port, SSLSocketFactory) and hands out any idle socket. Sequential use mostly works because the latest handshake rebinds the single idle socket; two threads sharing a CXFWSManClient can get each other's session. None of these contexts is ever disposed either.

[dino2gnt]

I re-jiggered this because relying on the keepalive pool to maintain the same connection across multiple threads probably wasn't going to work with any real concurrency. Fable helped.

[marshallmassengill]

Minor but I think this is worth doing.

[marshallmassengill]

I think this is good!

[dino2gnt]

Gonna wait for Chandra or Christian to critique it before I merge (no offense)