[Kerberos] Add Kerberos Realm

[bizybot]

This commit adds support for Kerberos Realm.
It caches User after successful authentication.
There can be only one Kerberos realm enforced via bootstrap check.

Depending on the AuthenticationResult it writes corresponding
response headers in thread context
success -> "WWW-Authenticate: Negotiate "
terminate -> 401 Unauhorized "WWW-Authenticate: Negotiate "

For user details, it uses native role mapper store.
In future we will be integrating with AD/LDAP via lookup realm

During testing found that PkiRealm, KerberosRealm would not be
able to register for refreshRealmOnChange with UserRoleMapper.
This change also addresses by changing to use CachingRealm instead
of CachingUsernamePasswordRealm.

Handling 'WWW-Authenticate' response header:

This change handles setting of 'WWW-Authenticate' reponse header.
I think we will have opinions over here how to handle it and I am open
for ideas.

As per RFC https://tools.ietf.org/html/rfc7235#section-4.1,
we can have custom Realms defining their own response header value for
'WWW-Authenticate' header. So the value for response header value is
driven by realms.
Introduced a default getWWWAuthenticateHeaderValue in Realm which uses
'Basic' auth scheme by default. There are some auth scheme which do not
specify anything related to WWW-Authenticate header like SAML. But most
of the realms would define or use the existing schemes like 'Basic',
'Digest', 'Bearer', 'Negotiate' etc.
For example, unofficially 'SAML' has been used as auth scheme for SAML.
At the startup, Security#createComponents will take care of creating
DefaultAuthenticationFailureHandler with default response header for
'WWW-Authenticate' header based on the ordering.

Testing:
Unit tests and manual testing freeipa env and curl api invocations.

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?
• If submitting code, have you built your formula locally prior to submission with gradle check?
• If submitting code, is your pull request against master? Unless there is a good reason otherwise, we prefer pull requests against master and will backport as needed.
• If submitting code, have you checked that your submission is for an OS that we support?
• If you are submitting this code for a class then read our policy for that.