Kill a bunch more BUF_strdup's - these are converted to have a check for
NULL before an intrinsic strdup.
ok miod@
Rewrite the description of the string_mask config file option to match
reality, and reformatting to be readable.

formatting and wording suggestions miod@ jmc@
Use Cm instead of Li for 'MASK:'
(Overlooked among jmc@'s other suggestions)
Handle failure of NETSCAPE_SPKI_b64_encode() and don't leak memory
when BIO_new_{file,fp}() fails.

inspired by a diff from logan@  ok miod@
In DES_random_key(), force the generated key to the odd parity before checking
it is not one of the weak and semi-weak keys.

Even though the probability of generating a weak key with incorrect parity is
abysmally small, there is no reason to be correct (although, if you're in a
need for fresh DES keys nowadays, you should seriously consider switching to
a stronger symmetric cipher algorithm).

ok beck@
Now that DES_random_key() can be trusted, use it to generate DES keys in the
EVP_CTRL_RAND_KEY method handlers, rather than generating a random odd key and
not even checking it against the weak keys list.

ok beck@
Check the return value of the UI functions (including UI_new() which return
value is happily dereferenced without checking it for being non-NULL).

ok beck@
Make sure PEM_def_callback() correctly handles negative buffer sizes; all uses
within libcrypto are safe, but until we can change this function prototype to
use size_t instead of int, better be safe than sorry.

tweaks and ok guenther@
level_add_node(): if a memory allocation failure causes us to attempt to clean
up and return failure, be sure the cleanup work does NOT free objects which
are still being referenced by other objects.

ok guenther@