SPNEGO/Kerberos: fails on accept-completed without AP-REP (no mutual auth)

[irvingoujAtDevolution]

When using SPNEGO/Kerberos (Negotiate) without requesting mutual authentication, the client receives negTokenTarg with negResult=accept-completed and no AP-REP, which is correct per server behavior. However, sspi-rs still tries to extract an AP-REP and fails in extract_ap_rep_from_neg_token_targ, aborting the handshake.

[TheBestTvarynka]

Unfortunately, this is not implemented. sspi-rs always expects mutual auth (even when it is not requested). This is one potential improvement for the future.