lib/krb5: correctly follow KRB5_KDC_ERR_WRONG_REALM client referrals