Add tests for gss_inquire_cred

Now that we're doing a kind of deferred credential acquisition for
krb5, the behavior of gss_inquire_cred is a bit more subtle because
(per RFC 2743 section 2.1.4) we have to choose a credential cache or
acceptor name sooner than we would otherwise do so.  Add a C program
to invoke gss_acquire_cred/gss_inquire_cred and some Python tests
using it.
Remove irrelevant to current code Novell copyright
Add debug mode to gssapi_alloc.h

Because the gssalloc macros are normally equivalent to malloc and free
on Unix, we cannot use the full test suite to find cases where we
allocate with malloc and free with gssalloc_free or vice versa.
Provide a way to test for this kind of bug (if only in a special build
configuration) by supporting a DEBUG_GSSALLOC symbol, which causes the
gssalloc wrappers to be deliberately incompatible with malloc and
free.
Use gssalloc in more parts of GSSAPI

Fix some GSSAPI buffer allocations which were missed in
800358b1790ef82710af0b6021c6ff2dca2b0de7: gss_export_sec_context,
gss_display_name, and IAKERB and SPNEGO token construction.

ticket: 7233 (new)
tags: pullup
Stop misusing gss_release_buffer in libgssrpc

Use free() instead of gss_release_buffer() when freeing buffers in
libgssrpc which weren't constructed by GSSAPI.  This mixing is
harmless in normal configurations (since libgssrpc is only used on
Unix), but fails with DEBUG_GSSALLOC.
Stop misusing gss_release_buffer in test programs

Use free() instead of gss_release_buffer() when freeing the locally
allocated context_token in the sample gss-server program.  Use
gssalloc_free() instead of free when freeing buffers in
t_kgss_kernel.c (where we can't use gss_release_buffer).
Fix nitpicky bugs in t_inq_cred
Use gssalloc in krb5_gss_export_name

krb5_gss_export_name uses malloc to construct a gss_buffer_desc value,
and should use gssalloc_malloc instead.

ticket: 7233
Add test coverage for gss_export_name

Exercise gss_export_name and importing of exported name tokens in
t_gssapi.py.
Silence a gcc warning in t_export_name

gcc warnings that nametype may be used uninitialized, presumably
failing to deduce that usage() never returns.  Initialize nametype to
make it build.
Remove obsolete function krb5_secure_config_files
New Replay Cache rst documentation
Edit rcache_def.rst for spelling and grammar
Cross-reference documents in mitK5defaults.rst
Fix apply_keysalt_policy bug

If apply_keysalt_policy is called with null result arguments (as from
kadm5_setkey_principal_3), we would dereference a null pointer if the
principal has no policy or no policy allowed_keysalts field, due to an
incorrect optimization.  Reported by Nico.

ticket: 7223
Updated Supported Versions document
Remove dead code in do_as_req.c

Commit r21692 removed the KRB5_KDB_NON_MS_PRINCIPAL flag.
Document preference order of enctypes in krb5.conf
Clean up k5buf_to_gss helper

k5buf_to_gss was used in only one place (generic_gss_oid_to_str),
where we want to include the terminating null byte in the GSS buffer.
Remove that assumption from the helper, and instead explicitly append
the null byte to the buffer before translating.
Add ASN.1 support for OTP

Add encoders and decoders for the OTP-TOKENINFO, PA-OTP-CHALLENGE,
PA-OTP-REQUEST, and PA-OTP-ENC-REQUEST types from RFC 6560.  For more
thorough testing, add support for generating test encodings using
asn1c for sample objects (currently only for the OTP types).