Add option to bypass CrackLib for longer passwords

Add option to bypass CrackLib for longer passwords

Add a trapdoor length, after which cracklib doesn't function.  This is
done via a cracklib_maxlen option to krb5.conf. passwords of that length
or shorter are still vetted.  (0, the default, performs the cracklib
fascist check at any length.)

CrackLib was designed to work with passwords, when passwords were 5-8
characters long.  CrackLib makes working with passphrases difficult,
rejecting some good ones.  The SQLite dictionary can be seeded with
Engligh trigrams, providing a compensating control.  Ergo, CrackLib
shouldn't be vetting passphrases; we should leave that to SQLite.