FTP: prevent the multi interface from blocking

As pointed out in Bug report #3579064, curl_multi_perform() would
wrongly use a blocking mechanism internally for some commands which
could lead to for example a very long block if the LIST response never
showed.

The solution was to make sure to properly continue to use the multi
interface non-blocking state machine.

The new test 1501 verifies the fix.

Bug: http://curl.haxx.se/bug/view.cgi?id=3579064
Reported by: Guido Berhoerster
test/README: mention the 1500 test number range
ftp_readresp: fix build without krb4 support

Oops, my previous commit broke builds with krb support.
libauthretry.c: shorten lines to fit within 80 cols
uniformly use AM_CPPFLAGS, avoid deprecated INCLUDES

Since automake 1.12.4, the warnings are issued on running automake:

  warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')

Avoid INCLUDES and roll these flags into AM_CPPFLAGS.

Compile tested on:
  Ubuntu 10.04 (automake 1:1.11.1-1)
  Ubuntu 12.04 (automake 1:1.11.3-1ubuntu2)
  Arch Linux (automake 1.12.4)
httpcustomheader.c: free the headers after use
RELEASE-NOTES: synced with fa6d78829fd30ad
gnutls: fix the error_is_fatal logic
gnutls: print alerts during handshake
gnutls: fix compiler warnings
CURLOPT_SSL_VERIFYHOST: stop supporting the 1 value

After a research team wrote a document[1] that found several live source
codes out there in the wild that misused the CURLOPT_SSL_VERIFYHOST
option thinking it was a boolean, this change now bans 1 as a value and
will make libcurl return error for it.

1 was never a sensible value to use in production but was introduced
back in the days to help debugging. It was always documented clearly
this way.

1 was never supported by all SSL backends in libcurl, so this cleanup
makes the treatment of it unified.

The report's list of mistakes for this option were all PHP code and
while there's a binding layer between libcurl and PHP, the PHP team has
decided that they have an as thin layer as possible on top of libcurl so
they will not alter or specifically filter a 'TRUE' value for this
particular option. I sympathize with that position.

[1] = http://daniel.haxx.se/blog/2012/10/25/libcurl-claimed-to-be-dangerous/
Revert "Zero out auth structs before transfer"

This reverts commit ce8311c7e49eca93c136b58efa6763853541ec97.

The commit made test 2024 work but caused a regression with repeated
Digest authentication. We need to fix this differently.
test1412: verify Digest with repeated URLs

This test case verifies that bug 3582718 is fixed.

Bug: http://curl.haxx.se/bug/view.cgi?id=3582718
Reported by: Nick Zitzmann (originally)
Curl_pretransfer: clear out unwanted auth methods

As a handle can be re-used after having done HTTP auth in a previous
request, it must make sure to clear out the HTTP types that aren't
wanted in this new request.
test 2027/2030: take duplicate Digest requests into account

With the reversion of ce8311c7e49eca and the new clear logic, this flaw
is present and we allow it.
curl: set CURLOPT_SSL_VERIFYHOST to 0 to disable
OpenSSL/servercert: use correct buffer size, not size of pointer

Bug: http://curl.haxx.se/bug/view.cgi?id=3579286
URL parser: cut off '#' fragments from URLs (better)

The existing logic only cut off the fragment from the separate 'path'
buffer which is used when sending HTTP to hosts. The buffer that held
the full URL used for proxies were not dealt with. It is now.

Test case 5 was updated to use a fragment on a URL over a proxy.

Bug: http://curl.haxx.se/bug/view.cgi?id=3579813
test1413: verify redirects to URLs with fragments

The bug report claimed it didn't work. This problem was probably fixed
in 473003fbdf.

Bug: http://curl.haxx.se/bug/view.cgi?id=3581898
Curl_connecthost: friendlier "couldn't connect" message