Correctly send empty IRC SASL responses. Fixes #15452
Added tag v2.10.7 for changeset ad7e7fb98db3
Fix a few warnings
Credit Jacob Appelbaum, Jurre van Bergen and Dieter Verfaillie in the ChangeLog
for their assistance with the win32 security fixes.
Update with the final released sha1sum for gtk-runtime-2.16.6.1.zip

 * This should have been done before the 2.10.7 tarballs were made :(
Slightly more accurate ChangeLog.
Merge with no conflicts
Activate development mode for 2.10.8
installer: Fix CheckSHA1Sum restoring the stack - this was broken in 51473787ff4f.

  * This ends up causing the downloaded file not to be extracted because the reference to the file is overwritten
  * Also, fix the downloading to download to a file with a space in the path
installer: remove Baltimore_CyberTrust_Root.pem, ValiCert_Class_2_VA.pem when uninstalling

 * Also delete stray backup files created by mono signcode
installer: update installer deps with a fixed NSIS SHA1Sum plugin that works on Windows XP
Fix from David Walser for a crash in the CAP plugin.
tcl: Fix dynamically loaded Tcl/Tk functions to be called using cdecl calling conventions.

Fixes #15520
win32: Use the libssp-0.dll from the gcc bin directory instead of based on a separate dependency.

 * Fixes #15521
jabber: avoid possible heap overflow when a very small file has been chosen for
        your own avatar

 * Thanks goes to Jacob Appelbaum for noticing this
 * The way this works is certainly not ideal, but libpurple doesn't depend on
   any image libraries.
CID 732106: Arguments in wrong order
Fix various "Dereference before null check" issues

 * Nothing problematic, just unnecessary NULL checks
Fix various other minor issues identified in the coverity scan.
Add a missing break.  I think maybe this was found by Coverity.
I'm not sure if this caused harm.  If it did, it would be something like:
1. You tried adding a buddy on oscar
2. It failed because you have too many items in your list
3. We sent an authorization request to the buddy

But maybe the auth request would have been ignored?  Auth requests
aren't used for AIM, and for ICQ you maybe would have already sent
an auth request, or you would need to send one in the future anyway,
so not a big deal.
Merge with no conflicts