Preliminary DANE support: per-destination trust-anchor digests.

Refactored internal verification callback machinery and re-implemented
fingerprint support via the new dane digest engine.

What remains now is to refactor smtp(8) to actually do DANE lookups
and build the appropriate policy structures on the fly.
New module for computing various digests and encoding fingerprints. Cut/paste from tls_dane.c.

Only real change is rename of tls_dane_serverid() to tls_serverid_digest().
Export functions to digest and fingerprint encode.

These will be needed to convert DANE digests from wire format.
Documentation cleanup.

Hyperlink postconf.proto TLS security levels to TLS_README.html
Cosmetic TLS_README.html cleanup
Split off session TLS policy parameters to a new structure.

We add a pointer to an SMTP_TLS_SESS to SMTP_SESSION to replace the
bunch of directly stored TLS parameters.

The SMTP_TLS_SESS structure is managed by a new module (which behaves
identically, after this commit, apart from the indirection).

This simplifies upcoming work.
Allow smtp_session_alloc() to fail gracefully and report an error.

With DANE TLS lookups contributing to TLS policy lookups DNS lookup
errors make this much more likely, so we need to return an suitable
DSN error structure from smtp_tls_sess_alloc() via smtp_session_alloc().
Add ctable_refresh.

Applications that store TTLs in the cached values can request that
a stale entry to flushed and a new one fetched.
Documentation of new DANE level and new parameters.
Implemented and enabled DANE security level.

    Question: Should lack of support for the chosen level just issue
    a warning or defer mail???

New utility function for clock-wrap safe time comparison.
Perhaps someone will still be using a 32-bit system in 2038.
New smtptls-finger utility.

This makes it much easier to test DANE, STARTTLS, etc, without
reconfiguring real mail flows.

Question: is the name smtptls-finger OK?
Question: is it OK to add a new file to $command_directory/ whose name
	  does not start with "post".
Question: Is it OK to install a mostly crippled version when TLS is
          disabled?  Without TLS all it can do is report the banner
	  and EHLO reply.

Note: The src/ sub-directory is the abbreviated name "tlsfinger",
but that seemed to generic a name to associate with an SMTP-only
utility.
Allow use of expired trust anchors that are not self-signed.
Support out-of-band full certificate trust anchors in DNS