Ban all Diffie-Hellman ciphers in Java 1.7.0_6 and higher

Addresses an issue in SSL/TLS/GSI sessions that approximately one
out of 256 connections fail with an 'invalid padding' error. This
affects gridftp, webdav with https, httpd with https, SRM and gsidcap.
It should be noted that this significantly reduces the number of
available ciphers.

It appears that Diffie-Hellman is broken in Java 1.7.0_6 and higher. This
patch bans those ciphers if a broken version of Java is used.

The patch adds new configuration properties for configuring whether
certain cipher families are banned:

dcache.security.ciphers
webdav.security.ciphers
httpd.security.ciphers
gsidcap.security.ciphers
srm.security.ciphers
gridftp.security.ciphers

The latter are defined in terms of the first. The property names follow
the schema agreed upon at the 2013 developers workshop. The patch
introduces a new configuration property group called security. It is
intended for general security related properties like authentication,
authorization, cryptography, etc.

Target: trunk
Request: 2.6
Request: 2.2-sha2
Require-notes: yes
Require-book: no
Acked-by: Dmitry Litvintsev <litvinse@gnal.gov>
Patch: http://rb.dcache.org/r/5616/
(cherry picked from commit 4cc7e3e6395388a7f98ad028b6c613cec8891c4f)
system-test: add ability to autogenerate host credentials

The system-test module creates a self-contained dCache instance.  It
does, however, require a host certificate, which currently is stored
in git.  The certificate was signed by a throw-away CA.

The host certificate stored in git makes use of the Globus
non-standard "host-certificate" extension ("CN=host/<name>").  This,
together with the lack of any subjectAltName extension means that only
Globus software will accept the host certificate.

Also, since the process for generating the certificate wasn't
documented, when the certificate runs out, generating a new
certificate may take some effort to create.

This patch adds support in the populate script for generating a
suitable host-certificate using OpenSSL.  The script
hostCredentials can generate a CA credentials, generates the host
credentials and installs the CA certificate, CA signing_policy and
host credentials, throwing away the CA private key.

By default, the host certificate has various DNS subjectAltName,
but if the --only-localhost option is specified then only
DNS:localhost is uesd.

The --install option will install the generated CA files in
~/.globus/certificates, so trusting the throwaway CA.

Target: master
Patch: https://rb.dcache.org/r/5529/
Acked-by: Gerd Behrmann

This patch adds support for generating the required host-certificate
using OpenSSL.  The process is triggered by running an extra script.
The script may also be used to install the trusted CA.
(cherry picked from commit 4e234a0f093c9b8b822aafe0c2aaf4886a964419)
pool: Make xrootd max frame size configurable

Addresses the issue that the xrootdMoverMaxFrameSize property was
ignored by the xrootd mover.

Target: trunk
Request: 2.6
Require-notes: yes
Require-book: no
Acked-by: Dmitry Litvintsev <litvinse@fnal.gov>
Patch: http://rb.dcache.org/r/5622/
(cherry picked from commit da723b40be7477b0568769cdc25020425d9acacf)
Merge pull request #95 from gbehrmann/fix/2.6/rb5622

pool: Make xrootd max frame size configurable
Merge pull request #93 from gbehrmann/fix/2.6/rb5616

Ban all Diffie-Hellman ciphers in Java 1.7.0_6 and higher
Merge pull request #92 from gbehrmann/fix/2.6/rb5529

system-test: add ability to autogenerate host credentials
Merge remote branch 'main/2.6' into feature/2.6/billing_soa
merged: http://rb.dcache.org/r/5641
merged: http://rb.dcache.org/r/5646