heimdal: always confirm PA-PKINIT-KX for anon PKINIT

Import upstream 38c797e1a.

Upstream notes:

RFC8062 Section 7 requires verification of the PA-PKINIT-KX key
excahnge when anonymous PKINIT is used.  Failure to do so can
permit an active attacker to become a man-in-the-middle.

Reported by: emaste
Obtained from: upstream 38c797e1a
Security: CVE-2019-12098
MFS requested by: re (cperciva)
Approved by: re (cperciva)

(cherry picked from commit 60616b445eb5b01597092fef5b14549f95000130)
(cherry picked from commit a311b9d70863f78c232d5622ee579c6cd45bb1d8)