Use new PATCHFILES:-patchlevel:group syntax
Convert some to option helpers
Move ignores off into Makefile.sanity
Update recommendation on secure usage
Add ECDSA warning for fix in r299902
Allow x509 patch to come from main mirror first