NetBSD portability fix and some performance tweaks in locking allocator
Darwin features
Remove debug headers
Fix an OCSP response decoding bug, we were not decoding KeyID properly.

Also prioritize checking the status code before the dates, as
otherwise an attacker could substitue a valid but expired response
which marked the cert as revoked and we would still just return
OCSP_EXPIRED. Obviously they can still play this game with an old
(valid) OCSP response, but no point making it easy.
Check Content-Length of HTTP responses
X.509 path validation now performs all possible tests and returns a
set of error codes, instead of failing immediately on first error.
This prevents a 'weak' error like an expired certificate from hiding a
major error such as signature validation failure or hard revocation.