net/389-ds-base: build against MIT Kerberos; fix GSSAPI SASL on FreeBSD

Add USES=gssapi:mit so ns-slapd links the ports MIT Kerberos
(security/krb5) used by the rest of the FreeIPA stack, plus two
FreeBSD-specific fixes so GSSAPI/GSS-SPNEGO binds work:

• ldaputil.c: locate the SASL plugins under ${LOCALBASE}/lib/sasl2 on FreeBSD (upstream only handles the Linux path).
• saslbind.c: register the GSSAPI acceptor keytab explicitly via krb5_gss_register_acceptor_identity(). ns-slapd starts as root and then drops privileges, so issetugid() is true and MIT Kerberos ignores KRB5_KTNAME; without this every GSSAPI bind fails with a permission error on the default keytab.

Sponsored by: Netzkommune GmbH