Preliminary DANE support: per-destination trust-anchor digests.

Refactored internal verification callback machinery and re-implemented
fingerprint support via the new dane digest engine.

What remains now is to refactor smtp(8) to actually do DANE lookups
and build the appropriate policy structures on the fly.
New module for computing various digests and encoding fingerprints. Cut/paste from tls_dane.c.

Only real change is rename of tls_dane_serverid() to tls_serverid_digest().
Export functions to digest and fingerprint encode.

These will be needed to convert DANE digests from wire format.
Documentation cleanup.

Hyperlink postconf.proto TLS security levels to TLS_README.html
Cosmetic TLS_README.html cleanup
Split off session TLS policy parameters to a new structure.

We add a pointer to an SMTP_TLS_SESS to SMTP_SESSION to replace the
bunch of directly stored TLS parameters.

The SMTP_TLS_SESS structure is managed by a new module (which behaves
identically, after this commit, apart from the indirection).

This simplifies upcoming work.
Allow smtp_session_alloc() to fail gracefully and report an error.

With DANE TLS lookups contributing to TLS policy lookups DNS lookup
errors make this much more likely, so we need to return an suitable
DSN error structure from smtp_tls_sess_alloc() via smtp_session_alloc().
Add ctable_refresh.

Applications that store TTLs in the cached values can request that
a stale entry to flushed and a new one fetched.
Documentation of new DANE level and new parameters.
Implemented and enabled DANE security level.

    Question: Should lack of support for the chosen level just issue
    a warning or defer mail???

New utility function for clock-wrap safe time comparison.
Perhaps someone will still be using a 32-bit system in 2038.