session: Refactor the writing of auth responses back to cockpit-ws

Make it so we can more easily compose messages and optionally
include fields of various types.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
session: If we receive delegated creds send them back to cockpit-ws

When we receive delegated credentials, send them back to cockpit-ws
so that it can use them to authenticate against other machines.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Provide a place in CockpitCreds to store GSSAPI creds

The GSSAPI creds represent a kerberos ccache (ie: one with a kerberos
ticket). We decode this on demand when needed.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Use GSSAPI creds to authenticate via SSH

When we have GSSAPI creds, use them to authenticate via SSH if
the peer server requests such authentication.

Refactor cockpit_ssh_connect(). In the process we also fix:

Fixes #1213
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: When cockpit-session sends creds use/store them

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
session: If gss_import_cred() not supported, warn in logs

If the GSSAPI credential import/export is not supported by the krb5
library on the system, then produce an intelligent warning in the logs.

Only do this if:

 * Delegated credentials were received
 * Tried to use delegated credentials

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Return a 'no-forwarding' protocol close reason if no forwardable creds

When trying to connect out to another host, and we don't have the
necessary creds to do it return 'no-forwarding' as the failure. The
user interface now shows something sensible in this case.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
doc: Add some hints about configuring Cockpit with SSO delegation

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Don't use ssh_gssapi_set_creds() if it's not available

Certain builds of libssh on debian don't export this function. It
is likely related to https://red.libssh.org/issues/173

Closes #1226
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>