(profile::util::keytab) make TGT non-forwardable

Generally, we want to allow ssh between 2 pair of hosts only. We don't
not want the TGT to be reusable to make another hop from the destination
host.  If additional access from the destination ssh host is needed, a
role user TGT should also be present on the destination host.

site/profile/manifests/util/keytab.pp

@@ -33,7 +33,7 @@
   }
 
   cron { 'k5start_root':
-    command => "/usr/bin/k5start -f ${keytab_path} -U -o ${uid} -k /tmp/krb5cc_${uid} -H 60 > /dev/null 2>&1",
+    command => "/usr/bin/k5start -f ${keytab_path} -U -o ${uid} -k /tmp/krb5cc_${uid} -H 60 -F > /dev/null 2>&1",
     user    => 'root',
     minute  => '*/1',
     require => File[$keytab_path],

spec/defines/util/keytab_spec.rb

@@ -33,7 +33,7 @@
 
       it do
         is_expected.to contain_cron('k5start_root').with(
-          command: '/usr/bin/k5start -f /home/foo/.keytab -U -o 123 -k /tmp/krb5cc_123 -H 60 > /dev/null 2>&1',
+          command: '/usr/bin/k5start -f /home/foo/.keytab -U -o 123 -k /tmp/krb5cc_123 -H 60 -F > /dev/null 2>&1',
         )
       end