cephx: control signaures for service vs cluster

Signed-off-by: Sage Weil <sage@inktank.com>
msg/Pipe: require MSG_AUTH feature on server if option is enabled

If we

  negotiate cephx AND
  are a server AND
  cephx require signatures = true

then require the MSG_AUTH feature bit.  Put this in the Policy struct for
this connection so that the existing feature bit checks and error reporting
are used, and the peer knows what feature it is missing.

Signed-off-by: Sage Weil <sage@inktank.com>
mon: enforce 'cephx require signatures' during negotiation

If we are negotiating which auth protocol to use, and the client does not
support the MSG_AUTH feature, and the server has 'cephx require signatures'
set to true, then remove cephx from the list of allowed protocols.

Also print something in the mon log so that we know wtf is going on.

Signed-off-by: Sage Weil <sage@inktank.com>
doc/rados/operations/authentication: update for cephx sig requirement options

Signed-off-by: Sage Weil <sage@inktank.com>
Merge branch 'wip-cephx'

Reviewed-by: Josh Durgin <josh.durgin@inktank.com>