Add support for NetBSD 5.x, NetBSD 6.x and DragonFly BSD.

Patches from pkgsrc.
Refactor digest functions and move from tls_verify.c to tls_fprint.c.

Also introduce new TLS_LEV_DANE security level, which is for now
disabled in tls_level.c

The TLS client props server id is now a string initially containing
"transport:address:port", which the library augments with a digest
of the external helo name (which can be long) plus any appropriate
internal library parameters.  With DANE the internal parameters
will grow quite large...
Export tls_fprint() and tls_digest_encode() for use in DANE.
Refactor the verification callback in preparation for DANE.
Split off SMTP per-session TLS policy code.
Allow smtp_session_alloc() to fail gracefully and report an error.

With DANE TLS lookups contributing to TLS policy lookups DNS lookup
errors make this much more likely, so we need to return an suitable
DSN error structure from smtp_tls_sess_alloc() via smtp_session_alloc().
Document smtp_tls_trust_anchor_file.
Reimplemented fingerprint support via DANE machinery and added per-site TAs.
Documentation of new DANE level and new parameters.

Hyperlink postconf.proto TLS security levels to TLS_README.html
Cosmetic TLS_README.html cleanup
Implemented and enabled DNS-based DANE security level.

    Question: Should lack of support for the chosen level just issue
    a warning or defer mail???
New smtptls-finger utility.

This makes it much easier to test DANE, STARTTLS, etc, without
reconfiguring real mail flows.

Question: is the name smtptls-finger OK?
Question: is it OK to add a new file to $command_directory/ whose name
	  does not start with "post".
Question: Is it OK to install a mostly crippled version when TLS is
          disabled?  Without TLS all it can do is report the banner
	  and EHLO reply.

Note: The src/ sub-directory is the abbreviated name "tlsfinger",
but that seemed to generic a name to associate with an SMTP-only
utility.