Enable TLS 1.2 clients

SSLUtil fails to recognize TLS 1.2 packets. Regardless of whether
the server supports TLS 1.2, failure to recognize the header prevents
it from falling back to an earlier revision of the protocol.

The change enables forward compatibility. Based on my reading of the
TLS 1.2 RFC, I think the server should recognize versions higher than
it actually supports and reply with a lower version number. I assume
that as long as the TLS major version is unchanged, the header format
is compatible.
Signal end-of-stream when remote sends a CLOSE notification

GlobusGSSCredentialImpl fails when the remote initiates a proper
SSL shutdown. The patch changes the logic such that rather
than throwing a generic error, the new ClosedGSSException is
thrown. The InputStream implementation recognizes this exception
and signals end-of-stream to the caller.
Merge pull request #135 from gbehrmann/fix/ssl-close

Signal end-of-stream when remote sends a CLOSE notification
Merge pull request #133 from gbehrmann/fix/tls12

Enable TLS 1.2 clients
Only cache CA's signing policy as not found after searching all entries

Currently, when ResourceSigningPolicyStore searches all signing policy
files, a failure to load any file results in the CA being stored in the
not-found cache, even though the CA likely has nothing to do with the
signing-policy file that failed to load.

A separate bug (in how wildcards are handled) means the scan through all
files will certainly fail if any CA has been removed since the JGlobus
application started.

Therefore, if a CA's hash is calculated incorrectly and some CA has been
removed then the CA's entry will be found the first time, but marked
in the negative cache.  Subsequent attempts to find the CA's signing
policy will fail.

This patch fixes this by only marking the CA as not found after an
exhaustive search.

Target: master
Request: 2.1
Request: 2.0
(cherry picked from commit 1555860b8ffbc125ff3f193fdc98e885728ab694)
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Avoid memory leak and stale information when scanning directories

The GlobusPathMatchingResourcePatternResolver class can scan a
filesystem for files matching some pattern.  Instances of this class
maintain an internal list of matches.  Successive calls to the
getResources method will append matching file paths and return the
complete list.  Note that (currently) there is no mechanism to reset the
internal list.

The ResourceSigningPolicyStore reuses the same Resolver instance for all
loadPolicy method calls, with three bad effects:

  1. files are included multiple times, potentially resulting in
     loading a policy file multiple times;

  2. the result list will always increase, eventually triggering an
     OOM;

  3. if a file is removed then, as the Resolver's result list will
     continue to have the file, an error will be reported.  The negative
     cache alieviates this third problem so an error is reported once
     every 10 hours.

This patch modifies the code so loadPolicy method creates a new Resolver
for each loadPolicy method call.  There is no additional filesystem
overhead (the previous code would also always scan the directory), but
the results are now accurate and do not contain duplicates.

Target: master
Request: 2.1
Request: 2.0
(cherry picked from commit 556b081d7e5d89b012bf38f626faf252e2ccaf34)
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>