- don't ignore krb5realm command line option (#174838)
    - read dns_lookup_realm and dns_lookup_kdc values correctly
    - the PAM configuration is now written in system-auth-ac file which is then
        symlinked from system-auth, the symlink is not overwritten so local PAM
        configuration is now possible (#165342)