Fix detection of expiry date on SUSE.

Most platforms set empty expiry date when it's removed, but SUSE sets
zero.

(cherry picked from commit e2ac255fe06736fdc85c10a049f6e1781b67a5c3)
Redmine #5864: Users promises: Work around group setting bug on SUSE.

If you set the same group as a secondary group, which is already the
primary group of the user, the group will not be set. This might be
expected behavior, but the problem is that it also happens if you
change the primary group at the same time.

Work around the issue by setting the primary group first, together
with an empty secondary group list, and then setting the secondary
group list afterwards.

(cherry picked from commit eb6ccf53afff33d50548bc8cd9d3e947b03eca45)
Make help string for --show-vars accurate.

The output includes variables discovered by the agent, and those
defined in policy that do not have a dependency to user-defined
classes (as those are evaluated after variables).

(cherry picked from commit c24fb0423782e106cbbc5e7b729779e18d49d85e)
pass the exact lenght of release_id in to xstrndup to avoid memory corruption on aix

(cherry picked from commit b5b32bfd250632890468f9e169fef51469bd94db)
Remove redundant test. It is 100% identical to 101.cf.

(cherry picked from commit 2988bce4c40438e888c393b2d21ce57cd0ab66ea)
Force method compliance from skipped to kept if callee bundle is skipped

Close #5762

(cherry picked from commit 76ad1f9c3c0055a3682135b261e682912b79177f)
Fix corner case in JSON escaped string parsing.

Add a few more unit tests. Redmine #5773

(cherry picked from commit 2ee04592edbc33497d4db1f4b27360a350993b82)
Redmine#5882: add perms mode 22222 to test cases

(cherry picked from commit ddfe86d2dbcb292363b9026f0a0a4cf84ee3613b)
Serverd now fails handshake from early on, if no client certificate is presented by the peer.

(cherry picked from commit 4ee79a83ef1e200fdb322ab2b28004024199c779)
Beatify source.

(cherry picked from commit 180151b9b024bdb3972ffe66cf6dfb2dec6b948e)
tls_generic_test now creates a different directory on each run.

Previously every time it failed we had to manually remove the
/tmp/tls_test directory, else it failed with different errors when
rerunning the test!

(cherry picked from commit 465c5d73f5ac5e3dc61110b7d05d3ef311e1457f)
Update tls_generic_test.

(cherry picked from commit 4045f7806c31e1d872d159fcacd9f26858aec534)
Fortify the TLS handshake callback.

Up to now the TLS handshake callback was always returning success, and
key checks were performed manually after a small identification
dialog. Today this is still the case, with some extra checks in the
handshake.

The reason is that the same callback is used not only for the initial
handshake, but for any "TLS renegotiation" handshake. During such a
handshake, either the client or the server can change almost every
parameter of the secure session, even their certificates. For our custom
usage of the TLS protocol this shouldn't be an issue, since we disregard
anything about certificates and only care about the first presented key
which we compare to the one in ppkeys directory.

However an attack was recently published ("triple handshake" attack, see
[1]), which is applicable to the TLS protocol up to and including
version 1.2, that requires an /active/ and /trusted server/ as man in
the middle attacker exploiting session resumption and renegotiation,
both standard TLS features. CFEngine is using TLS in a very custom
manner and is not in danger from that attack.

[1] https://www.secure-resumption.com/

Nevertheless, this patchset employs the countermeasures suggested by the
authors of the attack. In particular, if any change of certificate is
detected during renegotiation, the renegotiation handshake is denied. In
addition, many rigorous sanity tests were added in the handshake
callback, and CFEngine refuses the connection if anything seems to be
fishy. All checks were added in both server and client side.

(cherry picked from commit 32571b3b0f82bd2c369954ea856ada2b59d6e945)
Disable all renegotiation, resumption options and set safest defaults.

Reason is we want to expose a minimal attack surface on the very complex
TLS protocol and its implementations.

To disable TLS renegotiation and session resumption we need to turn off
the server-side session cache *and* disable session tickets (RFC 5077)
extension, see [1]. In the future we can always selectively re-enable
options in order to gain a performance boost.

[1] https://www.mail-archive.com/openssl-users@openssl.org/msg73185.html

Since we do not care about cross-browser compatibility and web, we also
disable all OpenSSL defaults that help with backwards compatibility.

(cherry picked from commit 2fc52bc965c878ea1859cb7c017a6d228b91215c)