krb5: Add calls to change and restore credentials
    
    In some cases we want to temporarily assume user credentials but allow the
    process to regain back the original credentials (normally regaining uid 0).
    
    Related:
    https://fedorahosted.org/sssd/ticket/2061