Reject on any channel bindings attribute mismatch
ABFAB (RFC 7055) is a new deployment.  In this case, it makes sense to
be very strict about channel bindings checks, because we have high
confidence that anyone supplying ABFAb channel bindings will supply
accurate info.

Other uses of channel bindings may require more liberal policies.
Add Moonshot-COI and Moonshot-APC attributes
Add ABFAB sample policy
* pre-proxy policy to enforce constraints that section 3.5 of RFC 7055
  say should be enforced near NAS

* authorize section to enforce policies enforced near home server according to RFC 7055 3.5
* Channel bindings policy to enforce ABFAB channel bindings
Virtual server for GSS-EAP (RFC 7055)

Include a virtual server for clients that use GSS-EAP (RFC 7055). This
server works both for proxies and for home servers that actually
perform authentication.
Updates and move some moonshot to Trust-Router
Module for PSK authorizations from ABFAB trust router