kerberos, dcerpc: tunnel KDC traffic through pkg/transport

[psycep]

Summary

• Kerberos KDC traffic (AS/TGS/kpasswd) leaked the operator IP under -proxy because the embedded jcmturner/gokrb5/v8 used hard-coded net.DialTimeout for KDC I/O, bypassing pkg/transport entirely. DCSync (via oiweiwei/go-msrpc/ssp/krb5) and the four DCOM tools leaked the same way through a second Kerberos library.
• Vendored jcmturner/gokrb5/v8 in-tree at pkg/third_party/gokrb5 with a required KDCDialer first argument on every client constructor — proxy-bypass is now a compile error. kerberos.TransportKDCDialer{} is the only production dialer; client.DirectDialer{} exists as an explicit escape hatch.
• DCERPC: set krbConfig.KDCDialer on every krb5.Config, pass dcerpc.WithDialer(transport.ContextDialer{}) on every dcerpc.Dial, and use the \"ncacn_ip_tcp:\" StringBinding prefix on the OXID-pivot dial to sidestep go-msrpc's hard-coded pre-dial net.LookupIP (so FQDN resolution stays on the SOCKS5 proxy).
• udp_preference_limit=1 and dns_lookup_kdc/realm=false stamped unconditionally; /etc/krb5.conf and $KRB5_CONFIG deliberately not read.
• KNOWN_ISSUES.md §8 updated with the new guarantee.

Test plan

End-to-end verified against a live GOAD lab with SOCKS5 over IAP-tunneled SSH:

• getTGT (sevenkingdoms / north / essos)
• smbclient -k (all three DCs)
• GetUserSPNs -k (Kerberoast — exchanges TGS via proxy)
• GetNPUsers (AS-REP — direct transport.Dial)
• getST (S4U2self/S4U2proxy)
• secretsdump -k DCSync — extracted krbtgt
• wmiexec -k — whoami returned north\\administrator
• smbexec -k — returned nt authority\\system
• NTLM/password regressions: smbclient, wmiexec, smbexec, secretsdump, PtH wmiexec -hashes — all clean
• tcpdump on operator host (filter: net 10.10.10.0/24 and not host 127.0.0.1): zero packets during the entire test matrix
• Negative control (same getTGT without -proxy): immediately emits direct SYNs to KDC, confirming leak class is real and detectable
• go build ./..., go vet ./..., go test ./... all clean

Conflict note

Branched from main@4890b97; remote has since merged 9 PRs. Likely conflicts on go.mod/go.sum (Azure/go-ntlmssp bump), possibly KNOWN_ISSUES.md, pkg/registry/hive.go-adjacent docs, and pkg/dcerpc/drsuapi/* (out-of-scope for this PR but on the same merge path). Will rebase before merge.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.