Move pa_data encoding into a separate function
Move forward tokeninfo filtering
Migrate to non-destructive tokeninfo selection
Add responder support to preauth_otp
Reset the prompt_types list after calling prompter

Reset the prompt_types list immediately after the prompter callback
returns, as is done everywhere else.
Sanity-check loading keys and certs from PEM files

Print a debug message if we're unable to locate the matching private key
for a certificate when we've just loaded both of them from PEM files.
Don't try to free an uninitialized keyblock
Make sure that pkinit_octetstring_hkdf() inits NSS

Create an NSS context for use when performing KDF, so that the tests,
which call into the function directly, will work.
Handle anonymous-as-signed-data-with-no-signers

Update to generate and consume signed-data with no signer-info, which we
need for anonymous PKINIT.
Correct type mismatches for get_as_key callbacks
Export krb5_cc_move()
Use hex escaping for non-printable trace data

When adding {str}, {lenstr}, or {data} to trace output, scan for
bytes which might be non-printable, and add them as hex-escaped
versions of themselves if any are found.
Add a -C flag to klist to also show config entries
Wait for correct message in t_iprop.py

The message "Got incremental updates from the master" precedes
actually replaying the updates on the slave.  Instead look for
"Incremental updates:" (the statistics message), which happens just
after the updates are replayed.

Also, we don't need to import time now that we're not sleeping.
Bump libkdb5 API and DAL versions

We made two sets of incompatible changes to the DAL and libkdb5 API
during development for 1.11 (master key list simplification and policy
extensions), so increment the appropriate version numbers.
Set pointers to NULL after freeing them
Add an input ccache get_init_creds option

Add a krb5_get_init_creds_opt_set_in_ccache() function.  An input
ccache may hold configuration data which the client libraries can
use to influence their decisions.
Add "pa_type" configuration to ccaches

* When producing preauth data, keep track of the type of padata in the
  KDC's list of acceptable types which prompted the module to produce
  padata.
* After obtaining credentials, store that value as a "pa_type"
  configuration item in the out_ccache.
* Read that allowed preauth type from an in_ccache, if possible.
* If we have an allowed preauth type, only call "real" modules that
  handle that value when filling in responder items and producing a
  client request.
Test in_ccache and pa_types functionality

* Add a krb5int_build_conf_principals() function to allow our get/set
  code to directly prune out duplicate config entries.
* Verify that when we specify a pa_type, it affects whether or not we
  will use a particular preauth plugin.
* Verify that we correctly save the KDC's preauth type number, that we
  tried to answer, to the out_ccache.
Add "pa_config_data" configuration to ccaches

* Read a "pa_config_data" item from an in_ccache, if provided, and add a
  callback which client preauth plugins can use to retrieve a string
  value from it that's keyed by a string.
* Add a callback which client preauth plugins can use to provide string
  key/value pairs to be stored in the ccache.