Include PA_ENC_TIMESTAMP in first AS-REQ to avoid bare preauth probe

The original getKerberosTGT() sent an initial AS-REQ without
PA_ENC_TIMESTAMP to discover the KDC's supported etypes and salt,
then followed up with an authenticated AS-REQ. This two-step pattern
is detectable as "AS-REQ without pre-authentication data followed by
TGS-REQ" and fingerprints impacket on the wire.

This change computes the Kerberos salt locally using the standard AD
convention (REALM + sAMAccountName) and includes PA_ENC_TIMESTAMP in
the very first AS-REQ. If the salt guess is wrong (e.g. case mismatch
or renamed account), the correct salt is extracted from the
KDC_ERR_PREAUTH_FAILED error response's e-data and the request is
retried — still with PA_ENC_TIMESTAMP, so no bare probe ever hits
the wire.

The kerberoast_no_preauth path (AS-REP roasting) is preserved as a
separate early-return branch that intentionally omits PA_ENC_TIMESTAMP.

Author: aconite33