iprop fixes (1/4) - Reset ulog upon policy change

When a policy change is enacted, a ulog reset is required, otherwise, the
slave servers do not receive a new full dump with the new policy definitions.
Principal updates may be referencing a "new" policy which doesn't exist
and fail.

Fix includes a block size edge condition in ulog_resize (if the ulog
entry size fit exactly in the blocksize, there is no need to resize, but
the existing code would have forced a resize)
iprop fixes (2/4) - kproplog

In preparation for another patch, and based on ulog being a circular buffer,
have kproplog loop through the ulog based on the index for the serial number
and assume early entries may be missing. Dereferencing of the ulog should be
consistent with how the KDC dereferences the ulog.

This works with both a ulog where the entry numbers range from m-n where the
number of entries may be smaller than the ulog limit and m need not be 1.
Because the KDC implements dereferencing based on the (sno-1)%size, this is
the correct way.  The current code worked only because the KDC previously
always starts the ulog # at 1, but would fail if the logic were ever changed
to allow another starting index (see next patch).
iprop patch (3/4) - Save iprop updates on slaves in ulog

This patch enables a slave to track changes from the master and commit them to
the local ulog.  This facilitates a slave to be promoted as a master and for
other slaves to still sync up because their last ulog state can be found.

In essence, when kpropd processes a ulog entry received via iprop, it will
also commit it to the ulog according to the locally configured ulog history
definitions/size to be maintained.

The first DB update when received from a full dump will be set.  Even though
the first entry is not available as an individual record update, it will be
the baseline for future ulog updates.  The first entry will be updated when
the ulog size reaches its limit, after which it will be based on the circular
ulog buffer.
iprop patch (4/4) - Allow iprop propagations from non-master KDC

This patch enables a slave to be pointed to a different server for receiving
the iprop updates instead of the defined realm master. This allows a site
to setup a tree based propagation hierarchy in case they want to use regional
servers and protect their WAN links. It also may be used in large environments
where there is a concern about too many slaves interacting with a single
master.