Add support for loading interposer modules

Extend the syntax of the gss mech config file to allow a module type
delimited by triangle brackets.  If the module type is "interposer",
flag the mechanism entry as being an interposer mechanism.  A module
marked as an interposer is loaded immediately (so it can interpose a
built-in mechanism) and produces a list of OIDs to interpose.
Interposer mechanisms are not exposed to applications.

[ghudson@mit.edu: Stylistic changes, commit squashing, commit
message]
Add primitives for using interposed mechanisms

Add gssint_select_mechanism() to determine what mechanism to use for a
caller-specified OID, gssint_get_public_oid() to determine what
mechanism to expose to the caller, and gssint_make_public_oid_set to
translate an array of mech OIDs into a set of public OIDs.  In
gssint_get_mechanism(), match interposed OIDs as well as real ones.

[ghudson@mit.edu: Stylistic changes, commit squashing, commit message]
Use interposer mechanisms in mechglue functions

Wherever a GSSAPI mechglue function accepts a mech OID from the
caller, use gssint_select_mech_type() to choose the mechanism to use.
Wherever a mechglue function outputs a mech OID to the caller, use
gssint_get_public_oid() or gssint_make_public_oid_set() to expose the
public mech OID.

[ghudson@mit.edu: Stylistic changes, commit squashing, commit message]
Add SPI calls to import objects by mech oid

An interposer mech needs to be able to handle multiple mechanisms.
When importing a mech token for a name, cred, or context, the
interposer mech needs to know the mech type of the token being
imported.  To make this work, add SPI calls which accept a mech type
argument.

[ghudson@mit.edu: Stylistic changes, commit squashing, commit message]
Fix a couple of typos
Add an input ccache get-init-creds option

Add a krb5_get_init_creds_opt_set_in_ccache() function.  An input
ccache may hold configuration data which the client libraries can
use to influence their decisions.
Use octal escapes for non-printable parts of {str}/{lenstr}/{data}

When adding {str}, {lenstr}, or {data} to trace output, scan for
bytes which might be non-printable, and add them as octal-escaped
versions of themselves if any are found.
Add a -C flag to dump configuration entries
Add "pa_types" configuration to ccaches

* When producing preauth data, keep track of the types of padata which
  the module that produced the data can handle.  Originally this was
  just the type of data we'd produced, but that caused problems for
  PKINIT.
* After obtaining credentials, store that list of preauth types as a
  "pa_types" configuration item in the out_ccache.
* Read a list of allowed preauth types from an in_ccache, if possible.
* If we have a list of allowed preauth types, skip any "real" modules
  which aren't in that list.
Add "pa_config_data" configuration to ccaches

* Read a "pa_config_data" item from an in_ccache, if provided, and add a
  callback which client preauth plugins can use to retrieve a string
  value that's keyed by a string.
* Add a callback which client preauth plugins can use to provide string
  key/value pairs to be stored in the ccache.
Use config storage for client identity selection

* Keep track of the names of client identities when we load them.
* Store the client identity we just used when we create or retry a
  client request.
* If we read a client identity from the configuration, treat it like the
  KDC does: pick the "this is it, there is no other" logic branch.
Use config storage for client token selection

* Save the vendor name of the token we used to create the challenge.
* If we saved the name of a token vendor previously, prune out any
  tokeninfos which contain different vendor names.
Misc fixes for anonymity and crypto agility

* Agility fix: don't try to free an uninitialized keyblock.
* Anonymity: don't try to sign data when we have no signer specified,
  and don't try to add signed attributes then, either.  Don't bail on
  unsigned data: just note that it's not signed, since that's expected
  now, and carry on.
* Reset the prompt_types list immediately after the prompter callback
  returns, as is done elsewhere.
* Use a temporary variable to hold the chain-inclusion setting for CMS.
* Whitespace tweaks.
* Print a debug message if we're unable to locate the matching private
  key for a certificate when we've just loaded both of them from PEM
  files.
* Create an NSS context for use when performing KDF, so that the tests,
  which call into the functoin directly, will work.
Test in_ccache and pa_types functionality.

* Add a krb5int_build_conf_principals() function to allow our get/set
  code to directly prune out duplicate config entries.
* Verify that when we specify pa_types, they affect whether or not we
  will use a particular preauth mechanism.
* Verify that we correctly save the list of preauth mechanisms that are
  used in out_ccaches.
project page draft; do not merge