Make t_iprop.py faster and more robust

Catch SIGUSR1 in iprop-mode kpropd so that we can use it to interrupt
sleeps and make kpropd do an iprop request immediately.

In k5test.py, add prod_kpropd and read_from_kpropd methods to allow
test scripts to send a SIGUSR1 to kpropd and to read its stdout/stderr
output; also allow the test script to specify additional arguments
when starting kpropd.

In t_iprop.py, start kpropd with -d and, instead of sleeping, read
kpropd output until we see an indication that kpropd is in sync with
the master.  To avoid delays, prod kpropd before waiting for sync and
after a completed full prop.
Add an input ccache get_init_creds option

Add a krb5_get_init_creds_opt_set_in_ccache() function.  An input
ccache may hold configuration data which the client libraries can
use to influence their decisions.
Use hex escaping for non-printable trace data

When adding {str}, {lenstr}, or {data} to trace output, scan for
bytes which might be non-printable, and add them as hex-escaped
versions of themselves if any are found.
Add a -C flag to klist to also show config entries
Add "pa_types" configuration to ccaches

* When producing preauth data, keep track of the types of padata which
  the module that produced the data can handle.  Originally this was
  just the type of data we'd produced, but that caused problems for
  PKINIT.
* After obtaining credentials, store that list of preauth types as a
  "pa_types" configuration item in the out_ccache.
* Read a list of allowed preauth types from an in_ccache, if possible.
* If we have a list of allowed preauth types, skip any "real" modules
  which aren't in that list.
Test in_ccache and pa_types functionality

* Add a krb5int_build_conf_principals() function to allow our get/set
  code to directly prune out duplicate config entries.
* Verify that when we specify pa_types, they affect whether or not we
  will use a particular preauth mechanism.
* Verify that we correctly save the list of preauth mechanisms that are
  used in out_ccaches.
Add "pa_config_data" configuration to ccaches

* Read a "pa_config_data" item from an in_ccache, if provided, and add a
  callback which client preauth plugins can use to retrieve a string
  value that's keyed by a string.
* Add a callback which client preauth plugins can use to provide string
  key/value pairs to be stored in the ccache.
Use config storage for client identity selection

* Keep track of the names of client identities when we load them.
* Store the client identity we just used when we create or retry a
  client request.
* If we read a client identity from the configuration, treat it like the
  KDC does: pick the "this is it, there is no other" logic branch.
Use config storage for client OTP token selection

* Save the vendor name of the token we used to create the challenge.
* If we saved the name of a token vendor previously, prune out any
  tokeninfos which contain different vendor names.
Reset the prompt_types list after calling prompter

Reset the prompt_types list immediately after the prompter callback
returns, as is done everywhere else.
Sanity-check loading keys and certs from PEM files

Print a debug message if we're unable to locate the matching private key
for a certificate when we've just loaded both of them from PEM files.
Don't try to free an uninitialized keyblock
Make sure that pkinit_octetstring_hkdf() inits NSS

Create an NSS context for use when performing KDF, so that the tests,
which call into the function directly, will work.
Handle anonymous-as-signed-data-with-no-signers

Update to generate and consume signed-data with no signer-info, which we
need for anonymous PKINIT.
Whitespace fixup

Use a temporary variable to hold the chain-inclusion setting for CMS.
project page draft; do not merge
Export krb5_cc_move()
Correct type mismatches for get_as_key callbacks