Fixes for S3 DCE/RPC GSSAPI with Heimdal

[Luke Howard]

> That would be a bug in the eap mechs then, and they work with firefox or SAP that don't call gss_release_oid
> 
> ISC needs to return an OID that the caller don't need to free. Just use a global to capture and return already allocated oids if they already exists.
> 
> gss_release_oid is not part of the gss-api spec.

OK, my bad. I can fix this (in time).

-- Luke