kerberos-identity: Attempt to cope with multiple credential caches per identity

At the moment the identity service assumes there will just be one credential cache collection for any given prinicipal.

This isn't necessarily true though, and the service gets quite confused when that assumption doesn't hold up.

This commit attempts to make it cope with the situation better, by maintaining a hash table of collections per identity. It deems one of the collections the "active" one and relegates the rest to be backup if the active one expires and can't be renewed.

Closes: #79 (closed)