Add two new parameters. The first is to add a line to the krb5.conf file
indicating that we prefer TCP. The other is a parameter stating which
kerberos environment we want: prod, test, or uat.

Some changes (such as the major changes to WIN.SLAC.STANFORD.EDU) were not
copied to the template file.

We don't have anycast DNS in Livermore, so this adds a parameter to base::dns,
a parameter that can be set via Hiera, to put Livermore's DNS server at (or
near) the top of the list.

On April 29, the Networking team notified all LNAs that the legacy "C" DNS
servers are being retired on November 1, and that they will start notifying
sysadmins this month if their systems are still querying the old DNS servers.

Correct template names for the impstats fragments that support
debugging rsyslog problems.  Update the documentation in the
base::syslog::fragment to make debugging a bit easier.

A problem in the way that ssh/gssapi authentication works can be
worked around by moving the anycast servers first.  We had reverted
this change in the past when networking told us anycast was not
ready for primetime, so this change has been well tested.  Now that
anycast is a production service moving to it will solve an immediate
problem.