RELEASE-NOTES: synced with 22adb46a32bee
FAQ: editorial updates

Several language fixes. Several reformats that should make the HTML
generation of this document look better.

Reported-by: Dave Thompson
easy: define away easy_events() for non-debug builds
FTP: remove krb4 support

We've announced this pending removal for a long time and we've
repeatedly asked if anyone would care or if anyone objects. Nobody has
objected. It has probably not even been working for a good while since
nobody has tested/used this code recently.

The stuff in krb4.h that was generic enough to be used by other sources
is now present in security.h
sasl: added basic SASL XOAUTH2 support

Added the ability to generated a base64 encoded XOAUTH2 token
containing: "user=<username>^Aauth=Bearer <bearer token>^A^A"
as per RFC6749 "OAuth 2.0 Authorization Framework".
options: added basic SASL XOAUTH2 support

Added the ability to specify an XOAUTH2 bearer token [RFC6750] via the
option CURLOPT_XOAUTH2_BEARER for authentication using RFC6749 "OAuth
2.0 Authorization Framework".
KNOWN_BUGS: refer to bug numbers with the existing number series

The old numbers would still redirect but who knows for how long...
security.h: Fixed compilation warning

ISO C forbids forward references to 'enum' types
imap: added basic SASL XOAUTH2 support

Added the ability to use an XOAUTH2 bearer token [RFC6750] with IMAP for
authentication using RFC6749 "OAuth 2.0 Authorization Framework".

The bearer token is expected to be valid for the user specified in
conn->user. If CURLOPT_XOAUTH2_BEARER is defined and the connection has
an advertised auth mechanism of "XOAUTH2", the user and access token are
formatted as a base64 encoded string and sent to the server as
"A001 AUTHENTICATE XOAUTH2 <bearer token>".
smtp: added basic SASL XOAUTH2 support

Added the ability to use an XOAUTH2 bearer token [RFC6750] with SMTP for
authentication using RFC6749 "OAuth 2.0 Authorization Framework".

The bearer token is expected to be valid for the user specified in
conn->user. If CURLOPT_XOAUTH2_BEARER is defined and the connection has
an advertised auth mechanism of "XOAUTH2", the user and access token are
formatted as a base64 encoded string and sent to the server as
"AUTH XOAUTH2 <bearer token>".
runtests.pl: allow -vc point to a separate curl binary to verify with

The specified curl binary will then be used to verify the running
server(s) instead of the development version. This is very useful in
some cases when the development version fails to verify correctly as
then the test case may not run at all.

The actual test will still be run with the "normal" curl executable
(unless the test case specifies something differently).
security.h: rename to curl_sec.h to avoid name collision

I brought back security.h in commit bb5529331334e. As we actually
already found out back in 2005 in commit 62970da675249, the file name
security.h causes problems so I renamed it curl_sec.h instead.
tool_urlglob.c: Fixed compiler warnings

warning: 'variable' may be used uninitialized in this function
curl: added basic SASL XOAUTH2 support

Added the ability to specify an XOAUTH2 bearer token [RFC6750] via the
--bearer option.

Example usage:
  curl --url "imaps://imap.gmail.com:993/INBOX/;UID=1" --ssl-reqd
  --bearer ya29.AHES6Z...OMfsHYI --user username@example.com
curl: added --bearer option to help

Added the --bearer option to the help output
RELEASE-NOTES: synced with acf59be7f09a7
curl: Moved check for password out of get parameter loop

Moved the calls to checkpasswd() out of the getparameter() function
which allows for any related arguments to be specified on the command
line before or after --user (and --proxy-user).

For example: --bearer doesn't need to be specified before --user to
prevent curl from asking for an unnecessary password as is the case
with commit e7dcc454c67a2f.
tool_operate.c: Fixed compilation warning

warning: implicit declaration of function 'checkpasswd'
ftpserver.pl: Added support for IMAP SEARCH command
multi_socket: improved 100-continue timeout handling

When waiting for a 100-continue response from the server, the
Curl_readwrite() will refuse to run if called until the timeout has been
reached.

We timeout code in multi_socket() allows code to run slightly before the
actual timeout time, so for test 154 it could lead to the function being
executed but refused in Curl_readwrite() and then the application would
just sit idling forever.

This was detected with runtests.pl -e on test 154.