printf: make sure %x are treated unsigned

When using %x, the number must be treated as unsigned as otherwise it
would get sign-extended on for example 64bit machines and do wrong
output. This problem showed when doing printf("%08x", 0xffeeddcc) on a
64bit host.
formpost: better random boundaries

When doing multi-part formposts, libcurl used a pseudo-random value that
was seeded with time(). This turns out to be bad for users who formpost
data that is provided with users who then can guess how the boundary
string will look like and then they can forge a different formpost part
and trick the receiver.

My advice to such implementors is (still even after this change) to not
rely on the boundary strings being cryptographically strong. Fix your
code and logic to not depend on them that much!

I moved the Curl_rand() function into the sslgen.c source file now to be
able to take advantage of the SSL library's random function if it
provides one. If not, try to use the RANDOM_FILE for seeding and as a
last resort keep the old logic, just modified to also add microseconds
which makes it harder to properly guess the exact seed.

The formboundary() function in formdata.c is now using 64 bit entropy
for the boundary and therefore the string of dashes was reduced by 4
letters and there are 16 hex digits following it. The total length is
thus still the same.

Bug: http://curl.haxx.se/bug/view.cgi?id=1251
Reported-by: "Floris"
RELEASE-NOTES: synced with 365c5ba39591

The 10 first bug fixes for the pending release...
curl.1: fix typo in --xattr description

Bug: http://curl.haxx.se/bug/view.cgi?id=1252
Reported-by: Jean-Noël Rouvignac
digest: improve nonce generation

Use the new improved Curl_rand() to generate better random nonce for
Digest auth.
digest: append the timer to the random for the nonce
url: restore the functionality of 'curl -u :'

This commit fixes a regression introduced in
fddb7b44a79d78e05043e1c97e069308b6b85f79.

Reported by: Markus Moeller
Bug: http://curl.haxx.se/mail/archive-2013-06/0052.html
lib506.c: Fixed possible use of uninitialized variables
darwinssl: SSLv2 connections are aborted if unsupported by the OS

I just noticed that OS X no longer supports SSLv2. Other TLS engines return
an error if the requested protocol isn't supported by the underlying
engine, so we do that now for SSLv2 if the framework returns an error
when trying to turn on SSLv2 support. (Note: As always, SSLv2 support is
only enabled in curl when starting the app with the -2 argument; it's off
by default. SSLv2 is really old and insecure.)
Merge branch 'master' of https://github.com/bagder/curl
examples: Moved usercertinmem.c to COMPLICATED_EXAMPLES

This prevents it from being built during a "make check" since it
depends on OpenSSL.
Added libmetalink URL; added Android versions.
Synced Makefile.vc6 with recent changes.

Issue posted to the list by malinowsky AT FTW DOT at.
Added winssl-zlib target to VC builds.
xc-am-iface.m4: provide XC_AUTOMAKE macro
configure: automake 1.14 compatibility tweak (use XC_AUTOMAKE)
curl.1: document the --time-cond option in the man page
curl.1: document the --post303 option in the man page
curl.1: document the --sasl-ir option in the man page
Revert "curl.1: document the --time-cond option in the man page"

This reverts commit 3a0e931fc715a80004958794a96b12cf90503f99 because
the documentation of --time-cond was duplicated by mistake.

Reported by: Dave Reisner