configure: Link appropriate binaries to krb5 libraries

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
common: Utility function for decoding hex strings

And tests

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Implement basic GSSAPI kerberos authentication

The actual authentication happens in cockpit-session, which has
access to the keytab

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Implement basic testing of kerberos auth during 'make check'

This requires the 'krb5-server' package or similar to be installed
while running 'make check'

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
static: Try an SSO login before showing the login form

This allows kerberos (ie: Negotiate, GSSAPI) SSO authentication to
happen before showing a login form.

Fixes #57
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
static: Don't use single sign-in if user explicitly logged out

When the user explicitly logged out, don't try and use single
sign in to authenticate. Otherwise the user would just be logged
in again.

There are two use cases here:

 * The user wants to finish the session and log out
 * The user wants to log in as someone else

So we force display of the login form in the case where logout
was explicitly used.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Send WWW-Authenticate: Negotiate header for any auth failure

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Test kerberos against host@COCKPIT keytab credentials

This is how it is used with Active Directory, and not necessarily
with HTTP specific kerberos SPN.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: If we can't resolve a real local name, use fully qualified

Use fully qualified kerberos user name if we cannot resolve it
into a valid local user via the kerberos routines.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Check negotiate authentication

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
selinux: cockpit-session uses GSSAPI which wants to write to tmpdir

GSSAPI writes to a replay cache. cockpit-session now uses GSSAPI
and needs to be able to write, read, delete from tmpdir

Symptom:

cockpit-session: gssapi auth failed: Unspecified GSS failure.
	Minor code may provide more information (Cannot create replay
	cache file /var/tmp/HTTP_0: File exists)

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
HACKING: Add instructions for how to configure SSO

This is a bit convoluted currently, but it's important to make this
reproducable and for people to be able to develop against it ... or
it will never ever get better.

Closes #1124