Make CFLAGS overridable.

If $CFLAGS is not last in the assignment, then you cannot override
flags like -O2.
tests/acceptance: improve default_check_strcmp and add default_check_regcmp
Redmine#3122: acceptance test for list interpolation order
tests/acceptance: s/difference/mismatch/
IsDir2().
Fixed documentation, added TODO.
Promise constification.
Changed "BAD:" to "BAD: "...

...makes it a bit harder to hit this message in random data and does not
break anything.

Also barely touched, and commented on newly introduced threading
issues. At some point the global connection cache was changed to a
different data structure, and concurrency issues were introduced: With
the old one (RList) we inserted new elements just by pointing them to
the existing list, so the existing list was never touched. Now with Seq
the list is in danger of being modified while being accessed. We must
revisit our global connection cache.
Made a couple of regexes more readable, without octal codes.
Some server access_rules attributes were missing in the RemoteAccess enum.

Changed declaration of some global syntax arrays to include their
size. In the future all should be declared with size, where size is
(MAX_ENUM_VALUE + 1), so that these bugs are warned by the compiler.
This is not a list-head but a list-tail.
Remove legacy stuff from new protocol's main loop.
Introduce realpath() alternative for windows.

Define PATH_MAX using windows' _MAX_PATH if available. Comment a bit
about the awfulness of realpath().
Run enterprise_extension_test only if Makefile has been generated.
Multi-tenancy.

Bundle server access_rules can now accept new constraints for each
entry: "admit_ips", "admit_hostnames", "admit_keys". Previous generic
"admit" constraint is deprecated, and the new ones do not accept generic
regular expression like it used to be the case.

The new thing is mostly in admit_keys. We can restrict specific files to
be accessible to specific hosts, not based on their IP address or
hostname, but based on their RSA key.

If the resource_type is "path" (default) then the promiser can now be a
path containing the special string "$(connection.ip)"
"$(connection.fqdn)" "$(connection.key)". By writing an access rule like
that, we can allow host-specific filenames to be accessible only to the
relevant hosts. Example:

   "/var/cfengine/cmdb/$(connection.key).json"
      shortcut   => "me.json",
      admit_keys => { "$(connection.key)" };

Moreover, notice the new "shortcut" constraint. This allows the agent to
request a file by its shortcut, and expansion is taking place on the
server according to this constraint in bundle server access_rules. This
is only for ease of use, a file can always be requested with its
absolute path.

The server tries to find an expansion for the first part of every
*non-absolute* (a.k.a. relative...) request path.  E.g. the source file
"masterdir/failsafe.cf" will be served by the server, only if you have
defined an ACL entry with shortcut=>"masterdir".

Enable source file in agent copy_from promises to be a relative path.
Delete relevant acceptance test.

All access control checking for the new protocol has been rewritten to
be clearer and more efficient. Old code still exists and is used in the
old protocol.

Old protocol: change DeleteAuthList() to be non-recursive, also add
asserts to verify list's consistency before freeing. Consolidated
repeated Auth list building code into a couple of functions:
GetOrCreateAuth() and AddAccessConstraintsToAuth(). Moved code
specific to the old protocol, to server_classic.c.
Mitigate possible uninitialised buffer read.
Change "struct strlist" to StrList.

Also document this rule in HACKING.md.

I consider it *wrong* to hide types with no obvious reason, especially
when I'm accessing internal fields of the struct all over the place, I
believe typedefs are good, but mostly for defining strict interfaces and
abbreviating extra-long types. Nevertheless I was flamed to death for
this and I need this code merged, so here is the change together with
relevant documentation; No, it was not obvious this was the rule.
Rename IsDir2() to IsDirReal().
Allow malloc() and friends.

This was changed recently, but this commit explains reasoning and comments
on controlled bailing out in case of some malloc() failures in cf-serverd.
Renamed access.[ch] to server_access.[ch].