multi: add timer inaccuracy margin to timeout/connecttimeout

Since all systems have inaccuracy in the timeout handling it is
imperative that we add an inaccuracy margin to the general timeout and
connecttimeout handling with the multi interface. This way, when the
timeout fires we should be fairly sure that it has passed the timeout
value and will be suitably detected.

For cases where the timeout fire before the actual timeout, we would
otherwise consume the timeout action and still not run the timeout code
since the condition wasn't met.

Reported-by: He Qin
Bug: http://curl.haxx.se/bug/view.cgi?id=1298
curl.1 document -J doesn't %-decode

...also added as KNOWN_BUG #87 with reference to bug #1294
gtls: respect *VERIFYHOST independently of *VERIFYPEER

Security flaw CVE-2013-6422

This is conceptually the same problem and fix that 3c3622b6 brought to the
OpenSSL backend and that resulted in CVE-2013-4545.

This version of the problem was independently introduced to the GnuTLS
backend with commit 59cf93cc, present in the code since the libcurl
7.21.4 release.

Advisory: http://curl.haxx.se/docs/adv_20131217.html
Bug: http://curl.haxx.se/mail/lib-2013-11/0214.html
Reported-by: Marc Deslauriers
THANKS: add contributors from 7.34.0 release

24 new great friends
RELEASE-NOTES: synced with c0ef05e67

... for the pending 7.34.0 release

Upped the contributor count
bump: start working on the next release
email: Renamed *_perform_authenticate() functions

In preparation for the upcoming SASL downgrade feature renamed the
imap__perform_authenticate(), pop3__perform_authenticate() and
smtp__perform_authenticate() functions.
imap: Moved the sending of the AUTHENICATE command into a separate function
pop3: Moved the sending of the AUTH command into a separate function
smtp: Moved the sending of the AUTH command into a separate function
imap: Moved the calculation of SASL login details into a separate function
pop3: Moved the calculation of SASL login details into a separate function
smtp: Moved the calculation of SASL login details into a separate function
smtp: fix compiler warning

smtp.c:478:21: error: unused variable 'smtpc' [-Werror=unused-variable]
gitignore: ignore .dirstamp files
RELEASE-PROCEDURE: new document
imap/pop3/smtp: Added support for SASL authentication downgrades

Added support for downgrading the SASL authentication mechanism when the
decoding of CRAM-MD5, DIGEST-MD5 and NTLM messages fails. This enhances
the previously added support for graceful cancellation by allowing the
client to retry a lesser SASL mechanism such as LOGIN or PLAIN, or even
APOP / clear text (in the case of POP3 and IMAP) when supported by the
server.
curl.1: remove URL encoding phrase from --data description

... it could be misleading a reader into thinking it _has_ to be encoded.
curl_easy_setopt: Fixed OAuth 2.0 Bearer option name

Bug: http://curl.haxx.se/bug/view.cgi?id=1313
Reported-by: Viktor Szakáts
pop3: Moved APOP detection into pop3_state_servergreet_resp()

In an effort to reduce what pop3_endofresp() does and bring the POP3
source back inline with the IMAP and SMTP protocols, moved the APOP
detection into pop3_state_servergreet_resp().