Don't allow the CAN_CREATE_ACCOUNT permission when server has no private key

In this situation, the server does not support creating accounts, because
it cannot generate client certificates.
Don't show subdirectory-only ACLs for leaf node in permissions dialog
Add the gnutls_x509_crt_get_dn() function
Associate certificates to users by DN instead of by key fingerprint

This allows easier transition when a user gets a new certificate, without
serious security degradations.
Fix a warning when the root ACL sheetset is empty
InfXmppConnection: Allow to change credentials after construction

But only as long as the credentials are not in use.
InfGtkBrowserView: Redraw also recursively on ACL change

This is necessary since when for example the "can-subscribe-session"
ACL is changed on a subdirectory, the icons for many nodes within the
subdirectory might need to be changed.