Add protection of our GSSCredential added by the KerberosLoginModule

GSSManager implementation can have an optimisation that attempts to obtain the GSSCredential from the private credentials in the Subject, in some situations such as JDBC drivers this can mean that a driver gets direct access to the credential we are supposed to be managing the lifecycle of.

The optimisation is based on checking if it is an instance of GSSCredentialImpl - if not then GSSManager creates a new instance.

This Jira issue is to wrap the instance we place in the Subject to prevent the optimisation kicking in. This then means code using the credential such as a JDBC driver is free to do what it wants with it's own credential without impacting on ours.