SPNEGO: Support for multiple kerberos realms

Usecase:

• I have environment with 2 kerberos realms (eg. REALM1.ORG and REALM2.ORG )

• I want to configure both kerberos realms in Keycloak realm

• During user authentication, if I receive SPNEGO header like: "Authorization: Negotiate some-token", I want to first try the SPNEGO authentication against kerberos realm REALM1.ORG.
  If it fails, then fallback to second realm REALM2.ORG .
  Only if the second realm fails too, just fallback to username/password form (or other configured authenticators) as it is now.

Implementation note:
Kerberos handshake can be done in multiple steps (HTTP requests). So it seems we will need to track the initial SPNEGO token sent by the browser in clientSession note, so the authenticator for REALM2 will be able to start with the initial token sent in the first request.

Example flow:
1) Browser sent "Authorization: Negotiate request-token-1"
2) SPNEGO authenticator for REALM1 returns "WWW-Authenticate: Negotiate response-token1"
3) Browser sent "Authorization: Negotiate request-token-2"
4) SPNEGO authenticator for REALM1 fails the SPNEGO handshake with request-token-2
5) Now I want to re-try SPNEGO authentication with REALM2. But I need the original token "request-token1" because browser won't send me another one. That's why the "request-token1" would be probably needed to be stored in the clientSession