kerberos: make sure credential cache sequence is always explicitly ended

The code currently fails to pair krb5_cc_start_seq_get with krb5_cc_end_seq_get
in an error case.  This can lead the cursor getting leaked.

https://bugzilla.gnome.org/show_bug.cgi?id=726353