gss: tidy up FQAN-extraction

The SRM interface and the dcap door extract a list of FQANs from a
certificate chain.  In the past, the caller was responsible for
supplying the objects used to achieve this; but, some time ago, this
changed and these objects are created within GSSUtils, independent of
the caller.

The interface was not updated to reflect this, so callers were forced
to create objects that were then not used.  Also, methods marked
themselves as throwing an Exception that they never do.

These wrinkles are fixed with this patch.

Target: master
delegation: add support for GridSite

This patch adds support for GridSite delegation v2.0.0.  The endpoint is
run as part of the SRM service and has the path /srm/delegation and
allows a user to delegate a credential, discover the remaining lifetime
of any delegated credential and destroy delegated credentials.  Those
credentials delegated via SRM and httpg have the delegated ID of 'gsi'.
Using this, a client may delete credentials delegated via SRM
operations.

Also included is a delegation client that allows scripted and
console-based interaction with GridSite endpoints.

Target: master
Requires-notes: true
Requires-book: true