Suppress fast NASes when proxying

If a NAS is sending the same packet many times per second,
we should ignore most of them.  We limit our retransmits
to no more than one per second.  That's still fast, but
much slower than stupid NASes
Make error messages clearer for users
Add always instances for all rcodes
Add temporary fix for credential accumulation in heimdal krb5

This isn't really a leak as the credentials will be removed as they expire,
but the standard operation of the krb5 verification functions isn't helpful
here.

The proper fix is to make it optional, and add credential caching code
to MIT too.
Don't segfault in rlm_unix if attributes are missing from the main dictionary
Fix double free on error in home_server_add

Fix potential issue with wrong free function being used in home_server_add
Formatting
Set secret to radsec for tcp+tls home servers
Don't try and load dh_params if no dh file provided
Output why we couldn't open the file 'does not exist' is not the reason in all cases
Update the Altiga dictionary with new values

Add new attributes and values to the Altiga networks dictionary
as found in the Cisco Prime 6.0 Access Registrar User Guide.

Add historical note about Altiga's aquisition in case someone is
(still) looking for Altiga-related documentation.
If inst->output is NULL, don't request output pairs from radius_exec_program
Proper encapsulation of information

the function to load dh params should check for a NULL filename.
The callers shouldn't care
Re-arrangement for ifdef WITH_TLS
WARN for old-style client configuration

so we don't have surprises
TLS clients and non-TLS listeners are forbidden
Load 10K of randomness, rather than 1M.
Use /dev/urandom for randomness, if it exists
fixes to cf_section_sub_find_name2

Short-circuit the answer where we can.
Expand the code to make it clearer what's going on.
So that more cases can be short-circuited
Add missed header check for features.h

Apparently nothing else checks for GNU versions of functions.

The libc ubuntu 12.04 ships with has the GNU version of strerror_r, whereas OSX has the Posix one. The compiler should of emitted a warning, as the return type of the functions differed, but didn't, for reasons best known to it.