Allow for service-level Kerberos descriptor to contain multiple services

Current Kerberos descriptor handlers assume only a single service may be identified in a service-level Kerberos descriptor file. However services like YARN include the MAPREDUCE2 service, thus multiple services need to be acknowledged.