I don't understand Kerberos, but Rishi kinda does, and he says we need
to make it use the KCM credential cache to have a chance inside flatpak.

It can be configured at build time, but that's not enough on its own. It
seems we need to install a krb5.conf.