Move the "MK_* options..." section before the "... MK_*_SUPPORT..." section

For the case that someone set WITHOUT_GSSAPI=, now WITHOUT_KERBEROS_SUPPORT
will be properly set.

This will likely fix the issue for the default case noted in the PR I filed
back in 2011. I am trying to fix the less obvious case documented in the PR
still.

MFC after: 2 weeks
PR: 159745