Improvements for AP-REP validation

[petrsnd]

Summary of changes:

• Expose ServiceTicketSessionKey and ClientSubSessionKey in ApplicationSessionContext while preserving existing functionality
• Try to decrypt AP-REP with all keys before failing
• Remove sequence number validation on decrypted AP-REP

What's the problem?

We are unable to implement a simple WinRM (HTTP/SOAP) connection setup using GSS-API Krb5 while simulating the WinRM protocol with Kerberos authentication. When selecting the Kerberos authentication option for Enter-PSSession, PowerShell uses Kerberos directly, not SPNEGO.

This change is to have Kerberos.NET make all keys available via the ApplicationSessionContext to validate GSS-API tokens. The observed behavior that we are following is that the AP-REP is validated with the service ticket session key, and then GSS Wrap/Unwrap uses the subkey returned from the server.

• Bugfix
• New Feature

What's the solution?

ApplicationSessionContext needs to keep track of sub session keys as well and try multiple options before giving up, in order to accommodate applications that may misbehave relative to common expectations and specifications.

ApplicationSessionContext should not try to validate that the sequence numbers match.

• Includes unit tests
• Requires manual test

The code in #398 can be used to manually test.

What issue is this related to, if any?

The issue is described in #398.

[petrsnd]

@SteveSyfuhs Would you like us to remove DecryptedKrbApRep_Validate_Sequence or try to make it work by passing in a custom validator with this implementation as the default?