regexec doesn't seem to initialised unused elements of rxmatch
Seeing as we now encode ethernet, and we check that ethernet VPs are the correct length, we should probably decode ethernet to.
correct the log/colourise logic
Rules for clang analyzer

do "make scan" for a LONG build, with lots of scanning,
and (for now) a number of errors.
Use clang analyzer macro to tell it about asserts
Clean rules for scan
Be more careful about initialization in a loop
One more minor assert
Realm struct to talloc
Removed duplicate code
Remove unnecessary assignment
Removed unused assignments
Assert to quiet clang analyzer
Assert to quiet clang analyzer
Rearrange code to quiet clang analyzer
Remove unused assignment
Assert to quiet clang analyzer
Note that the radsec shared secret is radsec
Allow clients to have "proto = tls".

This means tls is REQUIRED for them.  So if someone accidentally
allows that client for RADIUS/TCP, or RADIUS/TCP, the connection
will not be allowed.
set L_WARN to yellow, too