Use k5_transport enum type for k5_sendto

In k5_sendto and k5_locate_server, replace "socktype" parameters with
a new enumerator k5_transport, so that we can add new transports which
are not in the socket type namespace.

[ghudson@mit.edu: renamed type to k5_transport; clarified commit message]
[kaduk@mit.edu: name variables of type k5_transport 'transport']
[nalin@redhat.com: update the test program]
Build support for TLS used by HTTPS proxy support

Add a --with-proxy-tls-impl option to configure, taking 'openssl',
'auto', or invocation as --without-proxy-tls-impl.  Use related CFLAGS
when building lib/krb5/os, and LIBS when linking libkrb5.
Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGE

Handle encoding and decoding [MS-KKDCP] proxy messages, including
handling of the additional length bytes.  Early versions of [MS-KKDCP]
incorrectly omit that the size of the proxied message is prepended to
the proxied message, as it is when we're using plain TCP, before
encoding the proxy-message structure.  This is fixed at least as of
version 2.1 of the spec.

[nalin@redhat.com: handle the MS-KKDCP length bytes, add tests]
Dispatch-style protocol switching for transport

Switch to using per-transport-type functions when a socket that we're
using to communicate with a server becomes readable or writable, and add
them as pointers to the connection state.

[nalin@redhat.com: replace macros with typedefs]
[nalin@redhat.com: compare transports with TCP_OR_UDP rather than with 0]
[nalin@redhat.com: reorder conditional bits to always check for UDP first]
HTTPS transport (Microsoft KKDCPP implementation)

[nalin@redhat.com: use cleanup labels, make sure we always send the
 realm name, keep a copy of the URI on-hand, move most of the
 conditionally-compiled sections into their own conditionally-built
 functions, break out HTTPS request formatting into a helper function,
 update comments to mention specific versions of the MS-KKDCP spec,
 differentiate TCP and HTTP trace messages]
Add http_anchors, _revoke, and _hostname settings

Add http_anchors, http_revoke, http_hostname and
http_require_crl_checking settings, mimicking both the locations and
effects of their similarly-named PKINIT counterparts, but affecting
HTTPS connections to KDC proxy servers.

The hostname checking currently assumes UTF-8 everywhere.
Add a simple KDC proxy test server

This proxy server uses python-paste to run the kdcproxy from
https://pypi.python.org/pypi/kdcproxy.  It should be used along
with the proxy.pem certificate in ../tests/dejagnu/proxy-certs.
Add tests for MS-KKDCP client support

Exercise the MS-KKDCP client support using the test proxy server, for
AS, TGS, and kpasswd requests while also checking the certificate
verification and revocation and name checks.