ssh: prevent a logic error that could result in an infinite loop
valgrind.supp: added another test 165 suppression

This one seems to come and go as the optimizer decides how best
to inline some functions.
tests: disable valgrind on the remaining scp/sftp tests
tests: added missing HTTP NTLM auth keywords

Also, removed an unneeded strippart
tests: made the SASL modes separate keywords
nss: do not enable AES cipher-suites by default

... but allow them to be enabled/disabled explicitly.  The default
policy should be maintained at the NSS level.
nss: allow to enable/disable new HMAC-SHA256 cipher-suites

... if built against a new enough version of NSS
nss: allow to enable/disable new AES GCM cipher-suites

... if built against a new enough version of NSS