FAST: when parsing krb5_child response, make sure to not miss OTP message if it was last one

The last message in the stream might be with empty payload which means we get
only message type and message length (0) returned, i.e. 8 bytes left remaining
in the stream after processing preceding message. This makes our calculation at
the end of a message processing loop incorrect -- p+2*sizeof(int32_t) can be
equal to len, after all.

Fixes FAST processing for FreeIPA native OTP case:
https://fedorahosted.org/sssd/ticket/2186
responder: Set forest attribute in AD domains

Resolves:
https://fedorahosted.org/sssd/ticket/2160
cmocka unit test for authtok module added
LDAP: Add a new error code for malformed access control filter

https://fedorahosted.org/sssd/ticket/2164

The patch adds a new error code and special cases the new code so that
access is denied and a nicer log message is shown.
tests: Remove tests that check creating public directories

The functionality was removed, but we forgot to remove the corresponding
tests, mostly because these tests were only ever ran as root.
Update .gitignore for 'make check' built files
util: Fix const cast failures when building with -Werror

When building with -Werror 'make check' fails with many
errors like:

../src/tests/cmocka/test_authtok.c: In function ‘test_sss_authtok_password’:
../src/tests/cmocka/test_authtok.c:98:48: error: cast discards ‘__attribute__((const))’ qualifier from pointer target type [-Werror=cast-qual]

Make sss_authtok_set() @data argument const, and fix its documentation
util: A safe printf for user provided format strings

Since the default printf(3) implementation cannot safely be
used on user (or admin) provided input, this is a safe implementation.

This will be used in later patches by the full_name_format option
The implementation came from realmd, but only has libc dependencies.

The number of fields is pre-defined, and safe printf fails if
an invalid field is accessed.

Only string fields are supported, and only flags relevant to string
fields are supported. Width and precision work as expected, but
precision cannot read from a field.

Tests are included, and ported to the check based testing that
sssd uses.
NSS: Don't use printf(3) on user provided strings.

This also fixes several corner cases and crashers.

It's not prudent to pass user input to (even admin) input as a
format string to printf, and various distros now check for this.
This can cause accessing memory incorrectly, and various also
various libc abort()'s.

In addition various assumptions were made about full_name_format
that aren't necessarily the case if the user uses a more complex
format.

Use safe-printf.c implementation for formatting full_name_format.

Adapt the NSS resolver so it doesn't barf on formatted strings that
are shorter than expected given a full_name_format.

Tests added and updated appropriately.
Teach PAM client to do multi-pass

First cut at multi-pass in the PAM module.  We bump the version to 4 and
add a request item that contains both a context ID and a subcommand.

By default, that subcommand is "one-shot", indicating the traditional
behavior where the responder hands us a final reply.

When passed "multi_pass" as an argument, the module changes that
subcommand to "start".  So long as the reply comes back with status
INCOMPLETE and a substatus of to-be-continued (with a matching context
ID, of course), we parse out any AUTH_REQUEST items in the reply, select
a group of them to be attempted, collect answers for them, and submit
another request with the same context ID, a subcommand of "continue",
and their values as AUTH_ANSWERs.
Expand sss_authtok to handle secrets, OTPs, PINs
Display the type of PAM auth tokens when debugging
Rework item formats to meet lengths-first expectations
pam_sss: tag authtok items
pam responder: parse and pass along multistep info
Pass authtoks around; pass multi-step data to dp's