HTTPS transport (Microsoft KKDCPP implementation)

Add an 'HTTPS' transport type which connects to an [MS-KKDCP] proxy
server using HTTPS to communicate with a KDC.  The KDC's name should
take the form of an HTTPS URL (e.g. "https://proxybox/KdcProxy").

An HTTPS connection's encryption layer can be reading and writing when
the application layer is expecting to write and read, so the HTTPS
callbacks have to handle being called multiple times.

[nalin@redhat.com: use cleanup labels, make sure we always send the
 realm name, keep a copy of the URI on-hand, move most of the
 conditionally-compiled sections into their own conditionally-built
 functions, break out HTTPS request formatting into a helper function,
 handle the MS-KKDCP length bytes, update comments to mention specific
 versions of the MS-KKDCP spec, differentiate TCP and HTTP trace
 messages, trace unparseable responses]
When using KKDCP, load custom anchors and CRLs

Add http_anchors, http_revoke, and http_require_crl_checking settings
which we'll apply when using an HTTPS proxy, more or less mimicking the
locations and effects of their similarly-named PKINIT counterparts.
When using KKDCP, check the server's host name

When we connect to a KDC using an HTTPS proxy, check that the naming
information in the certificate matches the name we extracted from the
server URL in the configuration.
When using KKDCP, also match using "http_hostname"

When checking the naming information in a server certificate which we
receive when connecting to an HTTPS proxy, also accept the certificate
if it contains a name which matches a configured "http_hostname" value,
in an attempt to mimic to some extent the behavior we provide with the
"pkinit_kdc_hostname" setting.
Add a simple KDC proxy test server

This proxy server uses python-paste to run the kdcproxy from
https://pypi.python.org/pypi/kdcproxy.  It should be used along
with the proxy.pem certificate in ../tests/dejagnu/proxy-certs.
Add tests for MS-KKDCP client support

Exercise the MS-KKDCP client support using the test proxy server, for
AS, TGS, and kpasswd requests while also checking the certificate
verification and revocation and name checks.
Add some longer-form docs for HTTPS

Add some longer-form documentation for the new HTTPS support, walking a
prospective administrator through generating a bare minimal signing
setup, deploying a WSGI-based proxy server onto an Apache httpd server
using mod_ssl and mod_wsgi, and configuring clients to use it.