Add ticket-based Kerberos sign-ins

Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/745

This is meant as a replacement for omniauth-kerberos. This MR does not rip out or disable omniauth-kerberos, however, because that has the risk of locking out all Kerberos users on Kerberos-enabled GitLab server that does not have a service keytab yet.

On GitLab installations that have a keytab, namely those which have 'git access via SPNEGO' enabled, this change will automatically enable ticket-based sign-ins. 

See merge request !548