s3-net: allow to call "net ads kerberos pac <impersonation principal> -P".