When trying to establish a connection with Kafka using SASL with the
GSSAPI authentication mechanism the connection was hanging an timing out
after 60 secons. On the Kafka broker side I noticed that the
SaslServerAuthenticator was going from the AUTHENTICATE to the FAILED state.

The GSSAPI auth implementation was missing the second handshake defined in
RFC 2222, which happens after the security context is established. This
handshake is used by the client and server to negotiate the security layer (QoP)
to be used for the connection.

Kafka currently only support the "auth" QoP, so the implementation in this commit
doesn't make it configurable, but this can be extended later.

With this change I was able to successfully connect to a Kerberos-enabled Kafka
broker using the SASL_PLAINTEXT protocol and the GSSAPI mechanism.

The original intent was to catch API exceptions (errors returned by the
broker when trying to produce a message) and delegate them to the
messages' futures. This is copied from the Java producer.

However, we were accidentally catching all exceptions, thereby hiding
exceptions from users unless they explicitly check the result of the
future. Much better to raise client-side errors directly in the
foreground so the user is immediately aware of them and can decide how
to handle.

Fix #1274

Pulls in the fix upstream from https://github.com/mhils/backports.socketpair/pull/1