address memory leak in gnutls_pkcs11_crt_is_known()
pkcs11: when checking for presence do not give up on the first mismatch
tests: check gnutls_pkcs11_crt_is_known() when multiple same DNs are present
corrected remove_pkcs11_url()
tests: corrected check with gnutls_x509_trust_list_get_issuer
added FIPS140-2 DH verification functions
added FIPS140-2 ECDH verification functions
report the FIPS140-2 mode
pkcs11: when no CKA_ID can be relied on fallback on checking the SubjectKeyIdentifier

Patch by David Woodhouse.
Return an error if multiple PKCS11 URLs are added to a trust list

Before, the new URL would overwrite the old URL, and the memory of theold URL
would be leaked. It is documented that only one URL can be used, so it should
be safe to reject any attempt to add another one.

Signed-off-by: Armin Burgmeier <armin@arbur.net>
pkcs11: always check for a valid subjectKeyIdentifier match

That way, expired certificates can co-exist with their replacements.
pkcs11: do not shortcut checks when GNUTLS_PKCS11_OBJ_FLAG_COMPARE_KEY is specified
certtool: only set the authority key identifier, if there is a corresponding subject key identifier
tests: corrected test for v1 cert signing (removed bogus authorityIdentifier)
doc update
corrected the name of exported function
corrected assignment
simplify the handling of trust_list_get_issuer() when GNUTLS_TL_GET_COPY is not given
when both a trust module and additional CAs are present account the latter as well

That solves an issue in openconnect which used the system trust module,
plus additional certificates.

Conflicts:
	lib/x509/verify-high.c
doc update