array: Warn about caveat with array_remove_at() and value based arrays

Because enumerate() for value based arrays returns a pointer directly to
the internal array elements and because array_remove_at() or rather the
called array_remove() may move elements over the element at the currently
enumerated position, the pointer passed to enumerate() will point to a
different array element after the array_remove_at() call.  The caller
will thus operate on the wrong element if that pointer is accessed again
before calling enumerate().

For performance reasons we currently don't change the implementation to copy
each array element during enumeration to a private member of the enumerator and
return a pointer to that.  Similarly, due to the danger of subtle bugs we don't
remember the pointer passed to enumerate() to later redirect it to a copy
created during the array_remove_at() call.
array: Adjust negative index before calling remove_head|tail()

For ARRAY_TAIL we most often want to call remove_tail() not remove_head().
auth-cfg: Fix crash after several reauthentications with multiple authentication rounds

Due to the issue described in c641974, purge() inadvertently destroyed
CA certificates that should have been kept (while the pointer to these
objects remained in the array).  This lead to incorrect reference counts
and after a few reauthentications with multiple authentication rounds,
which cause calls to purge(TRUE), to crashes.
chunk: Fix Doxygen comments for chunk_internet_checksum[_inc]
kernel-netlink: Add global option to set MTU on installed routes
kernel-netlink: Add global option to configure MSS-clamping on installed routes
android: Report error if CHILD_SA rekeying fails
android: Reestablish IKE_SA if CHILD_SA rekeying failed
proposal: Fix equals()
child-cfg: Ignore duplicate proposals

If ESP proposals are added once with and once without DH groups
duplicates result during IKE_AUTH when DH groups are stripped.
android: Add DH groups to ESP proposals
android: Reduce CHILD_SA lifetime
Merge branch 'android-pfs'

Changes how CHILD_SA rekeying errors are handled in the Android app and adds
CHILD_SA proposals with DH groups.
ikev2: Properly keep track of pending MOBIKE updates

Because we only queue one MOBIKE task at a time, but destroy superfluous
ones only after we already increased the counter for pending MOBIKE updates,
we have to reduce the counter when such tasks are destroyed.  Otherwise, the
queued task would assume another task is queued when it is running and
ignore any successful response.
ikev2: Migrate number of pending MOBIKE updates

This will probably never be more than 1 since we only have one task queued
at a time and we don't migrate running tasks.
ikev2: Insert MOBIKE tasks at the front of the queue

In case we have no usable path to the other peer there is no point in
initiating any other tasks (like rekeying).
ikev2: Skip peer addresses we can't send packets to when looking for valid paths
ike-mobike: Skip peer addresses we can't send packets to when checking paths
ike-mobike: Add method to enable path probing
ikev2: Enable path probing for currently active MOBIKE task

This might not be the case if e.g. an address appeared but the old one
is still available but not actually usable.  Without this the MOBIKE
task would eventually time out even though we might be able to switch
to a working address.