backport a fix for keytabs which don't have keys for all enctypes
    
    - add a backport of Stef's patch to set the client's list of supported
      enctypes to match the types of keys that we have when we are using a
      keytab to try to get initial credentials, so that a KDC won't send us
      an AS reply that we can't encrypt (RT#2131, #748528)