pkcs12: added check for null OID in gnutls_pkcs12_generate_mac2
gnutls_pkcs11_obj_flags_get_str: mention UNWRAP
mac_to_entry -> _gnutls_mac_to_entry
_gnutls_pkcs12_string_to_key(): enforce a block size of 64-bytes
bumped current and age version to allow 3.3.x releases with new symbols
gnutls-cli: removed salsa20 from the benchmarked ciphers
gnutls-cli: more organized printing of cipher benchmark output
when checking the hostname of a certificate with multiple CNs use the "most specific" CN

In our case we use the last CN present in the DN. Reported
by David Woodhouse.

https://bugzilla.mozilla.org/show_bug.cgi?id=307234#c2
tests: check that gnutls_x509_crt_check_hostname() will correctly use the last CN when multiple
Follow the rfc6125 requirement that a single CN must be present for hostname verification.
gnutls-cli/danetool: added a common check for hostname being an IP
Follow the rfc6125 requirement that a single CN must be present for hostname verification.

Follow up on the original commit that simplifies checking for more than a single
hostname.
gnutls-cli/danetool: corrected check on ipv6 IPs
The environment variable GNUTLS_FORCE_FIPS_MODE can be used to force the FIPS-140-2 mode
gnutls-cli: added --fips140-mode command line option

That option will report the status of the FIPS140-2 mode in the library.