cockpit: Fix problems with JSON generation and parsing

Fix various issues with JSON generation that are present in upstream
json-glib:

https://bugzilla.gnome.org/show_bug.cgi?id=727593
https://bugzilla.gnome.org/show_bug.cgi?id=728951

In addition clean up our JSON parsing and generation API so we don't
have to constantly carry around JsonGenerator and JsonParser objects.

Fixes #413

Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
daemon: Remove workarounds for lousy JSON encoding

json-glib had a generator bug, and we do our own generation now.
So remove the hacks necessary to work around json-glib.

Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
spawn.js is auto-generated and .dirstamp is used internally by automake.
Let's ignore both.
common: Clearer split between CockpitPipe and CockpitPipeTransport

After this commit CockpitPipeTransport owns a CockpitPipe. This
simplifies the spawning constructors, and moves the cockpit-ws
logic into that code, rather than leaking it into common code.

In addition the "name" property of CockpitTransport, doesn't need
to be writable. Each of the transports now derive their logging name
from another property.

Closes #503

Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
ws: Use global tunables for setting testing/debug/mock options

Instead of cluttering up function signatures, use global tunables
to set tunables used during testing or in debug mode.

Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
cockpit: Add cockpit_json_parse_object() method

And make cockpit_json_parse_bytes() return a JsonObject. It's by far
the most common situation that we're parsing and writing JsonObject
rather than individual JsonNode. So make those cases realy easy.

Related to #413
Closes #508

Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
- Removed a merge conflict header
- Added an = NULL in cockptidbusjson.c
ws: Create CockpitCreds closer to pam_authenticate()

Create the PAM creds closer to pam_authenticate(), so we can use
the real user that PAM canonicalized, as well as return additional
information into the creds (later).

Remove the noop authorization check. We want to be respecting
system authorization, not inventing our own.
ws: Remove the cockpit_creds_take_password() function

It's not used, and not useful going forward.
ws: CockpitCreds with multi creds, remote host is a cred

As part of the build up to GSSAPI kerberos support we need to be
able to hold mulitple credentials in the aptly named CockpitCreds.

Move remote host credential to CockpitCreds. This is necessary
because we want to authenticate in cockpit-session and perform
that authentication from CockpitAuth
agent: Drop group privileges in cockpit-session

Correctly drop group privileges in cockpit session.

Fix #492
agent: Use err() and warn() in cockpit-session

Since cockpit-session is written without GLib, we can't use the
standard GLib logging, but we can use these stdlib functions for
handling printing our errors.
agent: Some minor cleanup in cockpit-session

Move global variables to top, and make some variables static rather
than global.
agent: Don't lookup the user twice in cockpit-session
agent: Return a proper error status if can't execute cockpit-agent

Fixes #498
agent: Set enviroment variables from PAM in cockpit-session

Don't let the cockpit-ws environment leak into cockpit-agent. Use
PAM to get the environment variable for the new process.

Fixes #497
common: Add 'problem' property to CockpitPipe

This can be used to retrieve the problem that the pipe closed
with, or NULL. But more importantly, it can be used to construct
a CockpitPipe for a failure.

Since CockpitPipe guarantees that it won't fire it's close
signals until the main loop, we follow that same guarantee
here with the "problem" property on construct.
ws: Allow CockpitCreds to be used as hash table key
ws: Run PAM authentication in cockpit-session process

The PAM modules are not necessarily thread-safe. In addition we
really want to run the 'auth' and 'session' stacks in the same
process, so later work with reauthorizing the agent can kick in.

This means sharing a cockpit-session process between the CockpitAuth
code and webservice code.

cockpit-session now accepts a '-p FD' argument, which tells it to
read a password from that FD, authenticate, and return the results
back on the same FD.

In the future we'll also want cockpit-session to return any kerberos
TGT it got during opening the session back to cockpit-ws, so we can
use store that TGT in the user's credentials, and use it to connect
to other servers.

Unfortunately we cannot use CockpitPipe to start the process in
CockpitAuth because of the way that CockpitWebServer runs handlers in
different threads (for now). So implement a simple work around and
create the CockpitPipe once in the websocket thread.

Closes #509
ws: Fix use after free in CockpitSshTransport

Caught by Valgrind and Travis CI
WIP authorization token documentation