Clean up iprop flow control in kdb5.c

Add a helper predicate to determine whether to log operations.  In the
predicate, check if the ulog is actually mapped.  Use a single cleanup
label in krb5_db_put_principal.  Use a cleanup label in
krb5_db_delete_principal instead of releasing resources individually
at each exit point.  Avoid locking and unlocking the ulog if we're not
logging (although it would be a no-op).

Based on a patch from Nico Williams <nico@cryptonector.com>.
Modernize style of kdb_log.c

ulog_get_entries had an unreachable branch which was removed during
de-indentation.
Fix iprop log reinitialization

If the master iprop log is reinitialized to serial number 0, slaves
will need to take a full dump--but after that happens, we need to know
whether the slave has taken that full dump, we we don't offering full
dumps indefinitely.

So, record a timestamp in kdb_last_time when we reinitialize the log
header, and compare the slave timestamp to kdb_last_time whenever it
has the current serial number, even if it's 0.  Test this by
performing a propagation with sno 0 in t_iprop.py and detecting
whether kpropd gets a second UPDATE_FULL_RESYNC_NEEDED response from
kadmind.

ticket: 7550 (new)
Verify iprop test results more thoroughly

In k5test.py, allow run_kadminl to take an environment argument.  In
t_iprop.py, perform some queries on the slaves after each propagation
to spot-check that it got modifications from master.  Use a helper
function to check serial numbers for conciseness.
Propagate policy changes over iprop via full dump

Since iprop cannot carry policy changes, force a full resync to happen
each time a policy change occurs.  Based on a patch from
Richard Basch <basch@alum.mit.edu>.

ticket: 7522
Remove ulog_check(); the ulog is not a DB journal

The db2 DB is not power-fail safe.  There's no point trying to
replay an incompletely committed entry from the ulog at kadmind
startup time.  For that matter, even if the db2 DB was power-fail
safe there'd be no point replaying an uncommitted entry from the
ulog as the libkadm5srv app (nor any client of it, as in the case of
kadmind) will not have received any notice of success -- it'd be
wrong to complete that operation later when the user thought it'd
failed.

[ghudson@mit.edu: merge with master, adjust comment]

ticket: 7552 (new)
Adjust kdb5.c check for ulog being mapped

Check the ulog pointer, which is a little more direct, rather than the
ulogfd field.  (ulogfd is currently initialized to 0 prior to
ulog_map; we could fix that instead, but this feels simpler.)
Quiet kpropd.c signed/unsigned comparison warnings

[ghudson@mit.edu: simplify slightly]
Check for negative poll timeout in k5_sendto_kdc

ticket: 7553
target_version: 1.11.1
tags: pullup
Fix h1 end tag in Sphinx header titles

A </h1> end tag was incorrectly written as <h1>.  Also adjust style
settings so that the resulting computed style remains the same for
div.rel.
Fix typos in layout.html

There were multiple misplaced semicolons, etc.
Fix "search" accesskey in layout.html

The accesskey for the "search" link conflicted with the one for the
"contents" link.
Consolidate style settings in kerb.css

Move style settings that were previously in layout.html to kerb.css.
Rename kerb.css kerb.css_t, making it a template, to allow
parameterized style settings to remain parameterized.
Reduce copied code in layout.html

layout.html unneccesarily copied code from the parent
agogo/layout.html content block just to alter the sidebar.  Override
various subblocks of the sidebar instead.
Refactor rellinks formatting in layout.html