IPA: Fix the PAM error code that auth code expects to start migration
    
    Recent patches which adds support for PKINIT in krb5_child changed a
    return code which is used to indicate to the IPA provider that password
    migration should be tried.
    
    With this patch krb5_child properly returns PAM_CRED_ERR as expected by
    the IPA provider in this case.
    
    Resolves:
    https://pagure.io/SSSD/sssd/issue/3394
    
    Reviewed-by: Simo Sorce <simo@redhat.com>
    Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>