Ticket #47359 - new ldap connections can block ldaps and ldapi connections

https://fedorahosted.org/389/ticket/47359
Reviewed by: lkrispen, nhosoi (Thanks!)
Branch: 389-ds-base-1.2.11
Fix Description: description
In the polling thread, first process all of the new connection requests from
the listening sockets, then process any new operation read requests
The listener_idxs keeps track of the index of the active listeners in the
poll fd array, and keeps a pointer to the listenfd object for that
listener.  This allows us to very quickly scan through the poll fd array
and find the ready listeners.  The work of scanning through the array
and handling the new connection requests has been moved to a new function
handle_listeners().
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 115ab1d9a3f026e8523b91bf62245a25454a3e8a)
(cherry picked from commit 24b751cc724468a7bce5f86848a82e4b03e24a3c)
(cherry picked from commit 5226ed9f2e585dc3d561f9286555efc7e3eea6b6)
(cherry picked from commit e0328aba6ed9254cf537f85927c55cbbb82cae77)
Ticket #47349 - DS instance crashes under a high load

https://fedorahosted.org/389/ticket/47349
Reviewed by: nkinder (Thanks!)
Branch: 389-ds-base-1.2.11
Fix Description: handle_new_connection initializes the connection object,
then calls connection_table_move_connection_on_to_active_list to put it
on the list of active connections, then unlocks the c_mutex, then calls
connection_new_private to allocate c_private.  If another thread
interrupts after the conn has been moved to the active list, but before
c_private has been allocated, the new conn will be available via
connection_table_iterate_active_connections where table_iterate_function
will attempt to dereference the NULL c_private.
The fix is to move connection_new_private inside the c_mutex lock, and to
move connection_table_move_connection_on_to_active_list to be the very last
thing before releasing the c_mutex lock.  Once the conn is on the active
list it is live and we cannot do anything else to it.
Note: I have still not been able to reproduce the problem in a non-debug
optimized build.
Platforms tested: RHEL6 x86_64
Note: Before patch, server would crash within 5 minutes.  After patch, server
has been running for several days in customer environment.
Flag Day: no
Doc impact: no
(cherry picked from commit 05d209432571dc64b242ae47113ae4cbb43607d2)
(cherry picked from commit 11c0f99aaa2deead80bde7e35dd9f9aabac5cc20)
Ticket 580 - Wrong error code return when using EXTERNAL SASL and no client certificate

Bug Description:  When doing a SASL EXTERNAL bind, and no client certificate is provided,
                  the bind succeeds(as anonymous).  However, the bind should fail with
                  an error 48.

Fix Description:  Check for the missing client certificate and return the appropriate
                  error.

https://fedorahosted.org/389/ticket/580

Reviewed by: Noriko(Thanks!)
(cherry picked from commit 2a81336e582c68fe0326a76a2f156b469688cc9b)