Document "first introduced version" in conf files

For the config options that were introduced starting from release 1.9,
specify the release number.
Fix void pointer arithmetic in oid_ops.c

When asserting that out has advanced the expected number of bytes in
generic_gss_str_to_oid, avoid adding to oid->elements, which is a void
pointer.  Instead subtract from out and compare.

ticket: 7524
Error on void pointer arithmetic with gcc

Add -Werror=pointer-arith to the gcc warning flags.  The equivalent
was added to the Solaris compiler flags in
2dc1ef4078acd7ca463a8eee2ef20de54e672f37 (r21886).
In MIT feature list doc update release number,refs
Update release numbers, refs in feature list doc

At the moment the latest release number is 1.11 and the  supported releases
are 1.10 and 1.9.
Also, update some references to the documents and fix typos.
Rename ccache configuration macros

KRB5_CONF_ prefix should be used for the krb5/kdc.conf parameters.
Use KRB5_CC_CONF_ prefix for cache configuration variables.
Stop loading policy for pw_expiration in LDAP

populate_krb5_db_entry() performs a subsidiary LDAP search to load the
password policy, which it uses to update the pw_expiration field.
This has some minimal value (it causes pw_expiration values in
principals to auto-update whenever the pw_max_life field of a policy
changes), but it's complicated, expensive, and inconsistent with the
DB2 back end.  Get rid of it.

ticket: 7535 (new)
Allow principals to refer to nonexistent policies

Stop using and maintaining the policy_refcnt field, and do not try to
prevent deletion of a policy which is still referenced by principals.
Instead, allow principals to refer to policy names which do not exist
as policy objects; treat those principals as having no associated
policy.

In the kadmin client, warn if addprinc or modprinc tries to reference
a policy which doesn't exist, since the server will no longer error
out in this case.

ticket: 7385
Consolidate policy tests into t_policy.py

Create a combined script for policy-related tests, and fold in the
existing lockout, password history, and allowed-keysalts tests.
Test more policy features

Add tests to t_policy.py for password quality enforcement, password
history (apart from the existing #7099 regression test), and for
references to nonexistent policies.
Fold kadm5 internal policy functions into callers

kadm5_create_policy and kadm5_modify_policy had _internal variants in
libkadm5srv (but not libkadm5clnt) which only existed to protect the
policy_refcnt field from modification over the wire.  Now that
policy_refcnt is no longer used, we don't need the separation.

Bump the library soname since this is technically an ABI change.
Remove dangling reference to $with_edirectory
Fix a compiler warning when checking for DH mode

As noted by others, and the compiler, rep->choice can't ever be set to
choice_pa_pk_as_rep_draft9_dhSignedData, so check for it in the correct
structure.
Avoid writing krbLastAdminUnlock during auditing

Try to avoid writing krbLastAdminUnlock when we're just doing auditing
in the KDC.  Because we know that kdb5_ldap_put_principal() only writes
the attribute when it's nonzero, we temporarily reset the value to make
sure that it isn't written.  This approach is a bit of a hack, but it
keeps the number of code paths affected by this change low.
Add an undocumented -x option for responder values

Add an undocumented -x option in the vein of the -X option, which
accepts question/answer pairs to be supplied by a responder callback.
Expected to only ever be useful for testing.
Add quick docs for KRB5_RESPONDER_QUESTION_PKINIT

Add some examples for KRB5_RESPONDER_QUESTION_PKINIT to the header
files.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Learn to prompt for passwords for PEM files

When we don't supply our own callback to PEM_read_bio_PrivateKey(), the
library uses its own, which interacts with the user via the controlling
terminal.  Here we provide a callback that calls the prompter instead.
Rename a couple of parameters for readability

We'll be adding another variable named "identity" later, to track the
name of the identity, so go ahead and give "label" and "id" names which
make it clearer that they're not identity names, but attributes of the
identity which were supplied by the caller.
Formatting fixup