heimdal: always confirm PA-PKINIT-KX for anon PKINIT

heimdal: always confirm PA-PKINIT-KX for anon PKINIT

Import upstream 38c797e1a.

Upstream notes:

    RFC8062 Section 7 requires verification of the PA-PKINIT-KX key
    excahnge when anonymous PKINIT is used.  Failure to do so can
    permit an active attacker to become a man-in-the-middle.

Reported by:	emaste
Obtained from:	upstream 38c797e1a
Security:	CVE-2019-12098
MFS requested by:	re (cperciva)
Approved by: 		re (cperciva)

(cherry picked from commit 60616b445eb5b01597092fef5b14549f95000130)
(cherry picked from commit a311b9d70863f78c232d5622ee579c6cd45bb1d8)