Replace rb_crypt_* functions with PBKDF2-HMAC-SHA512 from libcrypto and use the system C library crypt() for everything else
Replace the old ratbox challenge system with a new one.

This new challenge system has the server send a random string,
the client sign it, and the server verify the signature. This
lets the client use any key type capable of signing (e.g. RSA,
DSA, ECDSA).
Hash client certificates with SHA-256 (SHA-1 is now disallowed as per NIST SP800-131A)
Do a better job setting up TLS.

* Disallow any version of SSL.
* Mitigate implicit IV vulnerability in TLS 1.0
* Mitigate compression infoleak
* Use perfect forward secrecy only
* Use TLSv1.2 when acting as a client (connecting to servers)
* Use server preference of ciphersuites
Tell clients when they are connected with SSL/TLS.