iptables: Fix memory leak when invoking xtables_find_match

xtables_find_match() returns two different kind of pointers.
The first type is pointing to the function pointer table loaded
via dlopen(). The second type is a copy (via plain malloc) of the
first type. xtables_find_match() marks the copies/clones with
m == m->next. So we need to free the struct xtables_match which
point back to themself.

Also fix the issue that we didn't handle multple match instances
at the same time.

The memory leak is only visible when having more than one match
of a kind.
timeserver: Periodically wake up to recheck timeservers

The current situation is that a failed timeserver name resolution
removes the timeserver immediately from the list of used timeservers
and failing to connect to the nameserver IP address removes the
timeserver after a 2 second delay. Currently no mechanism exists to
re-create the list of nameservers once the list has been exhausted or
the more preferred timeservers have been removed from it.

This implementation combats both problems where less used timeservers
further away end up being used despite a more optimal closer one
becoming available as well as the problem of exhausting the
nameserver list. This is done by periodially waking up and checking
the timeserver in use. If the timeserver in use is not the most
preferred one or the list of timeservers is empty, the timeserver
list is recreated and the timeserver polling procedure is restarted.
TODO: Support other time sources
session: Add session argument to create_service_entry_cb

Remember which session this struct service_entry belongs to when
removing the entries again.
session: Do not access stale entry pointers

When removing the entry clear all references towards it.
session_policy_local: Do not handle small allocation

Let's remove the small allocations error path because glib will
abort on memory exhausting anyway. Basically we remove dead code.
session_policy_local: Refactor SELinux context parser

g_strplit() will eventually strdup the tokens so no need to
strdup() 'context'. But we an ugly cast (from 'const unsigned char *'
to 'const char *') is needed for g_strsplit() to make the compiler happy.
session_policy_local: Update session before unref policy

The update flag can be removed as it is no longer needed.
session_policy_local: Add some more debug information
session_policy_local: Rework policy file handling

The old assumption was that a config file is associtated
with one session only. With introducing UID/GID support a policy
might be used for several sessions. Furthermore, it was assumed
that the file name is the key/ident to identify a session and
a file containts exactly one policy.

Here are the new rules for writing a policy file.

- A valid file name contains letters or numbers and must have a '.policy'
  suffix.
- The file name has not semantical meaning
- A policy file may contain contain more than 1 policy
- Each policy entry starts with 'policy_'
- Each policy entry shall have one and exactly one valid key (e.g.
  selinux)

The implementation has two main hash tables, file_hash and session_hash
which owns 'the file' respectively the session config. Additionally there
is a hash table which connects a policy with a session (selinux_hash).
session_policy_local: Remove struct create_data

Use struct policy_data instead of struct create_data.
session_policy_local: Retrieve UID/GID from session user

When the session core ask to create a configuration, then we
first ask the D-Bus server which UID/GID the session belongs to.
If possible we also ask for the SELinux context. Then we try
to figure out which file containts the configuration for
SElinux, UID or GID identification.

The order of matching preference is SELinux, UID and finally GID.
session: Add session identification method to config

The session core needs to the know which kind of session
identification method has been selected in the plugin in order
to use the right iptables rules etc.
session_policy_local: Set session identification method

For SELinux we need to store the complete context for iptables
to work.
session-test: Add tests for session_policy_local

Use the UID as identification.
doc: Document session policy file format