Refactor gss mech config parser

Use helper functions to shorten and clarify loadConfigFile.
Remove NSIS installs when upgrading to 64-bit

The NSIS installer appears to have only ever existed as a 32-bit
software.  As such, unconditionally check the 32-bit registry tree
for an uninstall string; the architecture of the current package
being installed is not relevant to what was previously installed.

ticket: 7362 (new)
queue: kfw
target_version: 1.10.4
tags: pullup
Resolve verifier cred in accept_sec_context

If the verifier cred handle is of type GSS_C_BOTH, we need to resolve
the initiator part of it in order to create a s4u2proxy delegated
credential handle.  (If it's of type GSS_C_ACCEPT, kg_resolve_cred
won't do anything beyond locking and validating the credential.)

ticket: 7356
Keep verifier cred locked in accept_sec_context

It might have been safe to access the krb5 verifier cred without a
lock before constrained delegation, but it is less likely to be safe
now that we might access both the initiator and acceptor parts of the
cred.  Hold a lock on the cred for the full accept_sec_context
operation.

ticket: 7366 (new)
Export krb5_rc_recover_or_initialize on Windows

krb5_rc_recover_or_initialize is not a public function, but is now
used by the krb5 mechanism when importing a credential.  Mark it as
PRIVATE GSSAPI in the export list.
Export more krb5_rc symbols on Windows

krb5_rc_resolve_full, krb5_rc_resolve_get_name, and
krb5_rc_resolve_get_type are also now used in the krb5 mech.
Fix typo
Fix a couple of typos
Add an input ccache get-init-creds option

Add a krb5_get_init_creds_opt_set_in_ccache() function.  An input
ccache may hold configuration data which the client libraries can
use to influence their decisions.
Use octal escapes for non-printable parts of {str}/{lenstr}/{data}

When adding {str}, {lenstr}, or {data} to trace output, scan for
bytes which might be non-printable, and add them as octal-escaped
versions of themselves if any are found.
Add a -C flag to dump configuration entries
Add "pa_types" configuration to ccaches

* When producing preauth data, keep track of the types of padata which
  the module that produced the data can handle.  Originally this was
  just the type of data we'd produced, but that caused problems for
  PKINIT.
* After obtaining credentials, store that list of preauth types as a
  "pa_types" configuration item in the out_ccache.
* Read a list of allowed preauth types from an in_ccache, if possible.
* If we have a list of allowed preauth types, skip any "real" modules
  which aren't in that list.
Add "pa_config_data" configuration to ccaches

* Read a "pa_config_data" item from an in_ccache, if provided, and add a
  callback which client preauth plugins can use to retrieve a string
  value that's keyed by a string.
* Add a callback which client preauth plugins can use to provide string
  key/value pairs to be stored in the ccache.
Misc fixes for anonymity and crypto agility

* Agility fix: don't try to free an uninitialized keyblock.
* Anonymity: don't try to sign data when we have no signer specified,
  and don't try to add signed attributes then, either.  Don't bail on
  unsigned data: just note that it's not signed, since that's expected
  now, and carry on.
* Reset the prompt_types list immediately after the prompter callback
  returns, as is done elsewhere.
* Use a temporary variable to hold the chain-inclusion setting for CMS.
* Whitespace tweaks.
* Print a debug message if we're unable to locate the matching private
  key for a certificate when we've just loaded both of them from PEM
  files.
Use config storage for client identity selection

* Keep track of the names of client identities when we load them.
* Store the client identity we just used when we create or retry a
  client request.
* If we read a client identity from the configuration, treat it like the
  KDC does: pick the "this is it, there is no other" logic branch.