when checking the hostname of a certificate with multiple CNs use the "most specific" CN

In our case we use the last CN present in the DN. Reported
by David Woodhouse.
tests: check that gnutls_x509_crt_check_hostname() will correctly use the last CN when multiple
doc update
bumped versions
record: in DTLS discard only messages that cause unexpected packet errors
doc update
record: tolerate a finished packet with errors in DTLS
released 3.1.26
gnutls_x509_crl_verify: do not always set the invalid status

Reported by Armin Burgmeier.
Revert "gnutls_x509_crl_verify: do not always set the invalid status"

This reverts commit a80ce2926941fd490a6f7ef7c2846de90c28f818.
gnutls_x509_crl_verify: do not always set the invalid status

Reported by Armin Burgmeier.
do not define sigaction when in win32

Report and patch by Antoine Pierlot-Garcin
updated libopts to 5.18.3
doc update
doc update
restrict the number of non-fatal errors gnutls_handshake() can return

Conflicts:
	lib/gnutls_record.c
protect DTLS clients that don't handle GNUTLS_E_LARGE_PACKET from an infinite loop on handshake

Conflicts:
	lib/gnutls_int.h
	lib/gnutls_state.c