ike: Make check for known payloads depend on IKE version
ike: Only parse payloads valid for the current IKE version
ikev1: Accept IPComp proposals with 4 octet long CPI values

While they SHOULD be sent as 16-bit values according to RFC 3173
a responder MUST be able to accept CPI values encoded in four bytes.
ikev1: Use same map for AH and ESP authentication algorithms

The transform identifier used in AH transforms is not the same as the
authentication algorithm identifier used in the transform attributes in
AH (and ESP) transforms.
NEWS: Add note about AH algorithm mapping
Expanded bliss_bitpacker to 32 bits
unit-tests: added bliss_sampler test
Automatic generation of optimized Huffman codes
dumm: Fix -Wformat warning in ruby extension

In recent ruby versions, extensions get built with -Wformat. As we use custom
printf specifiers, that does not work for us. As there does not seem to be a
reliable way to override -Wformat, we use a variable for the format string,
which prevents gcc from doing the -Wformat check in that particular situation.
Pack private key arrays
eap-radius: Use the single-server legacy server options as fallback
vici: Add a destroy method to builder, allowing cancellation without error

When cancelling a builder, finalize throws an error which we might prefer
to avoid.
vici: Use silent builder destroy function in vici_free_req()
swanctl: Fail loading a connection if loading a cacert constraint fails
pki: Cache entered secrets in case they are needed more than once
pki: Load hmac plugin which is required to decrypt PKCS#12 containers
pki: Add simple PKCS#12 display command
pki: Reformat PKCS#12 output and add an index for each certificate/key
pki: Add command to export certificates and keys from PKCS#12 containers
pem: Handle BER indefinite length encoding as binary ASN.1

While our ASN.1 parser can't handle BER indefinite length encoding, the OpenSSL
backend can. Some PKCS#12 containers get encoded this way, so we should
support loading such files in the pem plugin.