gtls: respect *VERIFYHOST independently of *VERIFYPEER

Security flaw CVE-2013-6422

This is conceptually the same problem and fix that 3c3622b6 brought to the
OpenSSL backend and that resulted in CVE-2013-4545.

This version of the problem was independently introduced to the GnuTLS
backend with commit 59cf93cc, present in the code since the libcurl
7.21.4 release.

Advisory: http://curl.haxx.se/docs/adv_20131217.html
Bug: http://curl.haxx.se/mail/lib-2013-11/0214.html
Reported-by: Marc Deslauriers
THANKS: add contributors from 7.34.0 release

24 new great friends
RELEASE-NOTES: synced with c0ef05e67

... for the pending 7.34.0 release

Upped the contributor count
bump: start working on the next release
email: Renamed *_perform_authenticate() functions

In preparation for the upcoming SASL downgrade feature renamed the
imap__perform_authenticate(), pop3__perform_authenticate() and
smtp__perform_authenticate() functions.
imap: Moved the sending of the AUTHENICATE command into a separate function
pop3: Moved the sending of the AUTH command into a separate function
smtp: Moved the sending of the AUTH command into a separate function
imap: Moved the calculation of SASL login details into a separate function
pop3: Moved the calculation of SASL login details into a separate function
smtp: Moved the calculation of SASL login details into a separate function
smtp: fix compiler warning

smtp.c:478:21: error: unused variable 'smtpc' [-Werror=unused-variable]
gitignore: ignore .dirstamp files
RELEASE-PROCEDURE: new document
imap/pop3/smtp: Added support for SASL authentication downgrades

Added support for downgrading the SASL authentication mechanism when the
decoding of CRAM-MD5, DIGEST-MD5 and NTLM messages fails. This enhances
the previously added support for graceful cancellation by allowing the
client to retry a lesser SASL mechanism such as LOGIN or PLAIN, or even
APOP / clear text (in the case of POP3 and IMAP) when supported by the
server.
curl.1: remove URL encoding phrase from --data description

... it could be misleading a reader into thinking it _has_ to be encoded.
curl_easy_setopt: Fixed OAuth 2.0 Bearer option name

Bug: http://curl.haxx.se/bug/view.cgi?id=1313
Reported-by: Viktor Szakáts
pop3: Moved APOP detection into pop3_state_servergreet_resp()

In an effort to reduce what pop3_endofresp() does and bring the POP3
source back inline with the IMAP and SMTP protocols, moved the APOP
detection into pop3_state_servergreet_resp().
pop3: Moved CAPA response handling to pop3_state_capa_resp()

Similar to the processing of untagged CAPABILITY responses in IMAP and
multi-line EHLO responses in SMTP, moved the processing of multi-line
CAPA responses to pop3_state_capa_resp().
pop3: Fixed processing of more than one response when sent in same packet

Added a loop to pop3_statemach_act() in which Curl_pp_readresp() is
called until the cache is drained. Without this multiple responses
received in a single packet could result in a hang or delay.