s3-libads: Rework kerberos_return_pac() to use GENSEC for the server-side