session: Refactor the writing of auth responses back to cockpit-ws

Make it so we can more easily compose messages and optionally
include fields of various types.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
session: If we receive delegated creds send them back to cockpit-ws

When we receive delegated credentials, send them back to cockpit-ws
so that it can use them to authenticate against other machines.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Provide a place in CockpitCreds to store GSSAPI creds

The GSSAPI creds represent a kerberos ccache (ie: one with a kerberos
ticket). We decode this on demand when needed.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Use GSSAPI creds to authenticate via SSH

When we have GSSAPI creds, use them to authenticate via SSH if
the peer server requests such authentication.

Refactor cockpit_ssh_connect(). In the process we also fix:

Fixes #1213
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: When cockpit-session sends creds use/store them

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
session: If gss_import_cred() not supported, warn in logs

If the GSSAPI credential import/export is not supported by the krb5
library on the system, then produce an intelligent warning in the logs.

Only do this if:

 * Delegated credentials were received
 * Tried to use delegated credentials

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Return a 'no-forwarding' protocol close reason if no forwardable creds

When trying to connect out to another host, and we don't have the
necessary creds to do it return 'no-forwarding' as the failure. The
user interface now shows something sensible in this case.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
doc: Add some hints about configuring Cockpit with SSO delegation

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Don't use ssh_gssapi_set_creds() if it's not available

Certain builds of libssh on debian don't export this function. It
is likely related to https://red.libssh.org/issues/173

Closes #1226
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Don't print 'Unspecified GSS error' messages

These are pretty much useless. Skip over the 'unspecified' part
and try to get to the meat of the error.

Closes #1312
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
Use the term 'package' instead of 'module'

The packages really are just collections of resources, with the actual
html files and javascript files and (soon iframes) providing the actual
modular architecture.

In addition 'modules' is used a lot in the javascript community to do
with module loaders etc. We want to avoid confusion there.

Rename 'module' to 'package' everywhere. And move the modules/ directory
to pkg/ which is shorter and clearer.

Closes #1310