threading: Add a more explicit rwlock try_write_lock() testing
threading: Support rwlock try_write_lock() on Windows

We explicitly avoided TryAcquireSRWLockExclusive() because of crashes. This
issue was caused by a MinGW-w64 bug (mingw-w64 fix 46f77afc). Using a newer
toolchain works fine.

While try_write_lock() obviously can fail, not supporting it is not really an
option, as some algorithms depend on occasionally successful calls. Certificate
caching in the certificate manager and the cred_set cache rely on successful
try_write_lock()ing.
unit-tests: Re-align identification_create_from_string() unit test table data
identification: Support prefixes in string constructors for an explicit type
identification: Support custom types in string constructor prefixes
man: Document identification type prefixes in ipsec.conf(5)
swanctl: Document identity type prefixes
NEWS: Mention identity prefixes
Merge branch 'id-type-prefix'

Introduce generic identity prefixes to enforce a specific type.
constraints: Add certificate policy and policy mapping unit tests
constraints: Don't reject certificates with invalid certificate policies

Instead of rejecting the certificate completely if a certificate has a policy
OID that is actually not allowed by the issuer CA, we accept it. However, the
certificate policy itself is still considered invalid, and is not returned
in the auth config resulting from trust chain operations.

A user must make sure to rely on the returned auth config certificate policies
instead of the policies contained in the certificate; even if the certificate
is valid, the policy OID itself in the certificate are not to be trusted
anymore.
constraints: Add inhibitPolicyMapping tests
constraints: Add inhibitAnyPolicy tests
constraints: Add requireExplicitPolicy tests
constraints: Use a more specific FQDN/email name constraint matching

While RFC 5280 is not very specific about the matching rules of subjectAltNames,
it has some examples how to match email and FQDN constraints. We try to follow
these examples, and restrict DNS names to subdomain matching and email to
full email, host or domain matching.
constraints: Add permitted/excludedNameConstraints check
pki: Print and document the name constraint type for DNS or email constraints

As email constraints may be for a specific host, it is not clear from the
name itself if it is a DNS or email constraint.
Merge branch 'policy-constraints'

Fixes handling of invalid policies in end entity certificates by not rejecting
the full certificate, but just invalidating the affected policy. Additionally
adds a bunch of unit tests for the constraints plugin, and some minor fixes
to the nameConstraints handling.

Currently we still reject CAs that use invalid policy mapping; we should accept
such certificates and just invalid affected policies in a next iteration.

Fixes #453.
ikev1: Send INITIAL_CONTACT notify in Main Mode

We currently send the notify in Main Mode only, as it is explicitly not allowed
by RFC 2407 to send (unprotected) notifications in Aggressive Mode. To make
that work, we'd need to handle that notify in Aggressive Mode, which could
allow a MitM to inject such notifies and do some harm.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
ikev1: Don't inherit children if INITITAL_CONTACT was seen

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>