ws: Run PAM authentication in cockpit-session process

The PAM modules are not necessarily thread-safe. In addition we
really want to run the 'auth' and 'session' stacks in the same
process, so later work with reauthorizing the agent can kick in.

This means sharing a cockpit-session process between the CockpitAuth
code and webservice code.

cockpit-session now accepts a '-p FD' argument, which tells it to
read a password from that FD, authenticate, and return the results
back on the same FD.

In the future we'll also want cockpit-session to return any kerberos
TGT it got during opening the session back to cockpit-ws, so we can
use store that TGT in the user's credentials, and use it to connect
to other servers.

Unfortunately we cannot use CockpitPipe to start the process in
CockpitAuth because of the way that CockpitWebServer runs handlers in
different threads (for now). So implement a simple work around and
create the CockpitPipe once in the websocket thread.

Closes #509
common: Hold reference to CockpitPipe while emitting signals

While emitting CockpitPipe::read signal, hold a reference to
self, in case the signal handler unrefs the pipe, we can still
act in a coherent manner.

Caught by Travis and Valgrind.
common: Backport g_unix_fd_add() and friends

Backport the new g_unix_fd_add() and related functions which
define GSource's for unix fds. This prevents us from having to
define a custom GSource in CockpitPipe.

In addition we'd like to use these sources for the reauthorization
work.
cockpit: Make CockpitTransport an abstract base class

It doesn't need to be an interface. And as an abstract base
class we can have some implementation there.
common: Add new CockpitTransport::control signal

This signal is fired when a control message is received by the
transport, and no recv signal handler has processed it. We use it
in the agent, to have multiple handlers for control messages,
but still avoiding parsing and validating them multiple times.

In the case of the web service, since we're mainly forwarding
messages, we don't use this new signal.
doc: Add documentation for reauthorization scheme

And add documentation for the "authorize" protocol control
messages.
reauthorize: Implement pam_reauthorize.so PAM module

This doesn't actually make use of it in Cockpit yet. Includes tests
and various tools to try it out.

The tests require you to do do this (usually after each build):

$ sudo make enable-pam-tests

Otherwise many of them will just be skipped.

We don't use libtool. Building a PAM module doesn't require it. Our
PAM module is (currently) linux specific, and we can build shared
modules there just fine without libtool.
ws: Track CockpitWebSocket used credentials per session

Track the credentials we used to start a session on the session object
so we can refer to them later.
agent/ws: Send and process "authorize" messages

We now handle reauthorization requests from the pam_reauthorize.so
module, and send that to cockpit-ws for reauthorization.
Revert "common: Remove cockpit_log_null_handler"

This reverts commit 177e600e1fd6c8430583fa96bcd5e348752898b1.

Turns out we need this.
agent: Implement our own dummy polkit reauthorization agent

cockpit-agent now tells polkit that we're ready to handle
reauthorization requests. Although we don't handle any prompting
in our polkit agent. We rely on pam_reauthorize.so to send us
reauthorize requests via it's back channel instead.
web: Implement a basic 'Drop extra privileges' menu option

This tells cockpit-ws not to reauthorize polkit requests any longer.
May need some tweaking in the future, and probably needs to be
timeout driven in addition to this.

Includes the concept of poisoning CockpitCreds objects, so that while
still valid objects, the actual credentials (like password) are no
longer usable.
reauthorize: A much simpler reauthorize mechanism

 * We only support a polkit-agent now and the polkit agent reauthorizes
   in its helper using reauthorize_perform().
 * The pam_reauthorize.so module is still around, but it's only use is
   to derive the secret from the login password and put in the keyring.
 * No more listening/connecting to a reauthorization agent.
 * sudo is not covered by this, but the plan is to have a separate
   PAM module which reauthorizes sudo requests against polkit. All
   requests go through polkit.

To enable privileged tests, do:

 $ make enable-root-tests

Fixes #483
agent: Fix textstream to return exit-status and exit-signal

These codes weren't being set properly due to an invalid check.
Integration tests, distcheck, for reauthorize code

This adds an 'internal' page for testing these sorts of things.
In the long term we don't have to distribute this page as one of
our default modules.