ipa-kdb: for delegation check, use different error codes before and after krb5 1.20
    
    With MIT krb5 1.20, a call to krb5_db_check_allowed_to_delegate()
    and krb5_db_check_allowed_to_delegate_from() expects to return either
    KRB5KDC_ERR_BADOPTION for a policy denial or KRB5_PLUGIN_OP_NOTSUPP in
    case plugin does not handle the policy case. This is part of the MIT
    krb5 commit a441fbe329ebbd7775eb5d4ccc4a05eef370f08b which added a
    minimal MS-PAC generator.
    
    Prior to MIT krb5 1.20, the same call was expected to return either
    KRB5KDC_ERR_POLICY or KRB5_PLUGIN_OP_NOTSUPP errors.
    
    Related: https://pagure.io/freeipa/issue/9083
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Julien Rische <jrische@redhat.com>