MINOR: ssl: try to load Diffie-Hellman parameters from cert file

Feature is disabled if openssl compiled with OPENSSL_NO_DH.
DOC: ssl: update 'crt' statement on 'bind' about Diffie-Hellman parameters loading
MINOR: ssl: add elliptic curve Diffie-Hellman support for ssl key generation

Add 'ecdhe' on 'bind' statement: to set named curve used to generate ECDHE keys
(ex: ecdhe secp521r1)
DOC: ssl: add 'ecdhe' statement on 'bind'
MEDIUM: ssl: add client certificate authentication support

Add keyword 'verify' on bind:
'verify none': authentication disabled (default)
'verify optional': accept connection without certificate
                   and process a verify if the client sent a certificate
'verify required': reject connection without certificate
                   and process a verify if the client send a certificate

Add keyword 'cafile' on bind:
'cafile <path>' path to a client CA file used to verify.
'crlfile <path>' path to a client CRL file used to verify.
DOC: ssl: add 'verify', 'cafile' and 'crlfile' statements on 'bind'
MINOR: ssl: add fetch and ACL 'client_crt' to test a client cert is present

Useful in case of 'verify optional' to know if the client sent a certificate.
DOC: ssl: add fetch and ACL 'client_cert'
MINOR: ssl: add ignore verify errors options

Allow to ignore some verify errors and to let them pass the handshake.

Add option 'crt-ignore-err <list>'
Ignore verify errors at depth == 0 (client certificate)
<list> is string 'all' or a comma separated list of verify error IDs
(see http://www.openssl.org/docs/apps/verify.html)

Add option 'ca-ignore-err <list>'
Same as 'crt-ignore-err' for all depths > 0 (CA chain certs)

Ex ignore all errors on CA and expired or not-yet-valid errors
on client certificate:

bind 0.0.0.0:443 ssl crt crt.pem verify required
 cafile ca.pem ca-ignore-err all crt-ignore-err 10,9
DOC: ssl: add 'ca-ignore-err' and 'crt-ignore-err' statements on 'bind'
MINOR: ssl: add fetch and ACL 'ssl_verify_result'

This fetch returns the final ssl verify error.
DOC: ssl: add fetch and ACL 'ssl_verify_result'
MINOR: ssl: add fetches and ACLs to return verify errors

Add fetch 'ssl_verify_caerr':
returns the first ssl verify error at depth > 0 (CA chain).

Add fetch 'ssl_verify_caerr_depth':
returns the first ssl verify error depth (max returns is 15 if depth > 15).

Add fetch 'ssl_verify_crterr':
returns the fist ssl verify error at depth == 0.
DOC: ssl: add fetches and ACLs 'ssl_verify_crterr', 'ssl_verify_caerr', and 'ssl_verify_crterr_depth'
MINOR: ssl: disable shared memory and locks on session cache if nbproc == 1

We don't needa to lock the memory when there is a single process. This can
make a difference on small systems where locking is much more expensive than
just a test.
MINOR: ssl: add build param USE_PRIVATE_CACHE to build cache without shared memory

It removes dependencies with futex or mutex but ssl performances decrease
using nbproc > 1 because switching process force session renegotiation.

This can be useful on small systems which never intend to run in multi-process
mode.
MINOR: ssl : add statements 'notlsv11' and 'notlsv12' and rename 'notlsv1' to 'notlsv10'.

This is because "notlsv1" used to disable TLSv1.0 only and had no effect
on v1.1/v1.2. so better have an option for each version. This applies both
to "bind" and "server" statements.
DOC: ssl : add statements 'notlsv11' and 'notlsv12' and rename 'notlsv1' to 'notlsv10'.

This applies both to "bind" and "server" statements.
MEDIUM: config: authorize frontend and listen without bind.

This allows to easily add/remove "bind" entries to a frontend without
being forced to remove it when the last entry is temporarily removed.
While "disabled" may sometimes work in a frontend, it becomes trickier
on "listen" sections which can also hold servers and be referenced by
other frontends.

Note that a "listen" section with no "bind" is equivalent to a "backend"
section.

Configs without any listeners are still reported as invalid and refuse
to load.
MINOR: ssl: add statement 'no-tls-tickets' on bind to disable stateless session resumption

Disables the stateless session resumption (RFC 5077 TLS Ticket extension)
and force to use stateful session resumption.
Stateless session resumption is more expensive in CPU usage.