- resync with development branch:
    - refresh patch for #542868 from trunk
    - move man pages that live in the -libs subpackage into the regular
        %%{_mandir} tree where they'll still be found if that package is the
        only one installed (#529319)
    - and put it back in
    - back that last change out
    - try to make gss_krb5_copy_ccache() work correctly for spnego (#542868)
    - make krb5-config suppress CFLAGS output when called with --libs (#544391)
    - ksu: move account management checks to before we drop privileges, like su
        does (#540769)
    - selinux: set the user part of file creation contexts to match the current
        context instead of what we looked up
    - configure with --enable-dns-for-realm instead of --enable-dns, which
        isn't recognized any more
    - move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation,
        where it's actually needed (#538703)
    - add some conditional logic to simplify building on older Fedora releases
    - don't forget the README