Added "walk" function to conditions

So that we can do post-processing
Allow for one/two-pass compilation of conditions.

If we allow two-pass compilation, certain errors are suppressed,
and the condition gets marked with a "pass2 flag"
Do a second pass over the conditions.  Fixes #421

Modules can register new attributes, so we may need to convert
literal comparisons to module comparisons.

The core can register new values for Auth-Type && friends
so we need to do a second pass to see if a failed lookup in pass1
is really a failure, or simply an early binding.

The next step is to add code to mark up late-registered paircompare
functions