On systems where strerror_r is not the POSIX version, define it to
k5_strerror_r.  Implement k5_strerror_r in libkrb5support using
strerror_s, strerror, or the GNU strerror_r as appropriate.

ticket: 7961

In socket-utils.h, replace the socklen macro with an inline function
sa_socklen which always uses the address family, even on platforms
with the sa_len sockaddr field.  This removes the need to set sa_len
in socket addresses we construct.

This functions allows you to pass IPv4 and IPv6 addresses.  If no
address is given, t will determine the family by checking the socket
with getsockname.

[ghudson@mit.edu: clarified commit message, split out setport helper,
squashed with next commit, minimized code changes from old
bindresvport, used socket-utils.h helpers]

ticket: 7935 (new)

Add sa_setport, sa_getport, and sa_is_inet helpers for conveniently
manipulating port numbers on IPv4 and IPv6 socket addresses.

Fix three mismatched constant names, and properly alphabetize and
columnize the lists of definitions.  No functional changes.

This is just a shorter internal name for krb5_set_error_message.  The
full name is so long that we have to wrap error messages more than
we'd like.

It wasn't being used and it added too much complexity to the
error-handling functions.

When we connect to a KDC using an HTTPS proxy, check that the naming
information in the certificate matches the name or address which we
extracted from the server URL in the configuration.

ticket: 7929

Add an http_anchors per-realm setting which we'll apply when using an
HTTPS proxy, more or less mimicking the syntax of its similarly-named
PKINIT counterpart.  We only check the [realms] section, though.

ticket: 7929

Add an 'HTTPS' transport type which connects to an [MS-KKDCP] proxy
server using HTTPS to communicate with a KDC.  The KDC's name should
take the form of an HTTPS URL (e.g. "https://proxybox/KdcProxy").

An HTTPS connection's encryption layer can be reading and writing when
the application layer is expecting to write and read, so the HTTPS
callbacks have to handle being called multiple times.

[nalin@redhat.com: use cleanup labels, make sure we always send the
 realm name, keep a copy of the URI on-hand, move most of the
 conditionally-compiled sections into their own conditionally-built
 functions, break out HTTPS request formatting into a helper function,
 handle the MS-KKDCP length bytes, update comments to mention specific
 versions of the MS-KKDCP spec, differentiate TCP and HTTP trace
 messages, trace unparseable responses]

ticket: 7929