nixos/sssd: add an option to enable KCM support

[danc86]

Description of changes

Adds an option to enable Kerberos Cache Manager (KCM) support in SSS. See the sssd design doc about KCM for background info. The short version is that this lets other Kerberos client programs (kinit / klist) share a credentials cache with sssd, and take advantage of its renewals etc.

KCM is enabled by default in Fedora's sssd package.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 22.11 Release Notes (or backporting 22.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[danc86]

Result of nixpkgs-review pr 182520 run on x86_64-linux 1

1 package built:

• nixos-install-tools