ldap_child: sanitization of error handling
    
    Error handling was done wrong in a few aspects
    in ldap_child_get_tgt_sync() function.
    
    As per documentation:
    "The behavior of krb5_get_error_message() is only defined
    (1) the first time it is called after a failed call to a krb5 function
     using the same context, and
    (2) only when the error code passed in is the same as that returned
    by the krb5 function."
    
    Both (1) and (2) were violated heavily.
    
    Additionally in some cases ldap_child_get_tgt_sync() declared as
    returning `krb5_error_code` was actually returning non krb5 error code.
    
    Reviewed-by: Sumit Bose <sbose@redhat.com>