S4U2Self/S4U2Proxy delegation

Impacket getST uses S4U2Self to obtain a service ticket to the delegating service for a named user, then S4U2Proxy to request a ticket to an allowed service principal name (SPN) on that user's behalf. The delegating principal must authenticate and be authorized by the applicable Active Directory constrained-delegation policy; this does not let any domain account impersonate arbitrary users. Password, AES key, NT hash, and a matching Kerberos ccache are alternative authentication inputs. The resulting service-ticket ccache proves ticket issuance only, not acceptance or authorization by the target service. Optional -altservice changes the service name stored in the returned ticket after issuance; whether another service accepts it depends on that service's key and configuration.