Unify kvno option documentation

Add missing kvno options to the kvno.rst synopsis and option
descriptions, and to the kvno usage message.  Remove mention of '-h'
(help text), from kvno.rst as it is an implicit option.  Note that the
three new caching options were added in release 1.19.

Indicate the two exclusions (-u/-S and --u2u with the S4U2Self options)
and dependency (-P on S4U2Self) where they are missing.

Switch xusage() to print only a single localized string, rather than
running each line of output through localization separately.

Leave kvno -C undocumented for now, as the semantics of
KRB5_GC_CANONICALIZE are minimally useful and likely to change.

[ghudson@mit.edu: edited documentation and commit message]

ticket: 7476
tags: pullup
target_version: 1.18-next

1 files changed, 13 insertions, 11 deletions

diff --git a/doc/user/user_commands/kvno.rst b/doc/user/user_commands/kvno.rst
index 718313576..65c44e1c0 100644
--- a/doc/user/user_commands/kvno.rst
+++ b/doc/user/user_commands/kvno.rst
@@ -10,13 +10,9 @@ SYNOPSIS
 [**-c** *ccache*]
 [**-e** *etype*]
 [**-q**]
-[**-h**]
+[**-u** | **-S** *sname*]
 [**-P**]
-[**-S** *sname*]
-[**-I** *for_user*]
-[**-U** *for_user*]
-[**-F** *cert_file*]
-[**--u2u** *ccache*]
+[[{**-F** *cert_file* | {**-I** | **-U**} *for_user*} [**-P**]] | **--u2u** *ccache*]
 *service1 service2* ...
 
 
@@ -39,13 +35,18 @@ OPTIONS
     of all the services named on the command line.  This is useful in
     certain backward compatibility situations.
 
+**-k** *keytab*
+    Decrypt the acquired tickets using *keytab* to confirm their
+    validity.
+
 **-q**
     Suppress printing output when successful.  If a service ticket
     cannot be obtained, an error message will still be printed and
     kvno will exit with nonzero status.
 
-**-h**
-    Prints a usage statement and exits.
+**-u**
+    Use the unknown name type in requested service principal names.
+    This option Cannot be used with *-S*.
 
 **-P**
     Specifies that the *service1 service2* ...  arguments are to be
@@ -76,16 +77,17 @@ OPTIONS
 
 **--cached-only**
     Only retrieve credentials already present in the cache, not from
-    the KDC.
+    the KDC.  (Added in release 1.19.)
 
 **--no-store**
     Do not store retrieved credentials in the cache.  If
     **--out-cache** is also specified, credentials will still be
-    stored into the output credential cache.
+    stored into the output credential cache.  (Added in release 1.19.)
 
 **--out-cache** *ccache*
     Initialize *ccache* and store all retrieved credentials into it.
-    Do not store acquired credentials in the input cache.
+    Do not store acquired credentials in the input cache.  (Added in
+    release 1.19.)
 
 **--u2u** *ccache*
     Requests a user-to-user ticket.  *ccache* must contain a local