Kerberoasting detection gaps in mixed-encryption environments and why 0x17 filtering alone isn't enough