s3-gensec: Add hook to allow gensec to know if kerberos is permitted