Rewrite the description of the string_mask config file option to match
reality, and reformatting to be readable.

formatting and wording suggestions miod@ jmc@
Drop the "... during install" comments; they were missing in several
places and it makes things simpler: no need to check for file existence.

discussed with and ok deraadt@ rpe@
Use Cm instead of Li for 'MASK:'
(Overlooked among jmc@'s other suggestions)
Handle failure of NETSCAPE_SPKI_b64_encode() and don't leak memory
when BIO_new_{file,fp}() fails.

inspired by a diff from logan@  ok miod@
Convert from <sys/endian.h> to the shiney new <endian.h>

ok dtucker@, who also confirmed that -portable handles this already
use ansi style function declarations
with suggestions from and ok guenther@
Tweak after recebt rc.securelevel change.
Drop quotes and mention that 3 and not 2 variables can be overridden.

ok robert@
tab->space; consistent with the other sysctl values.
<netinet/in_systm.h> is no longer needed.
Fewer <netinet/in_systm.h> !
Fewer <netinet/in_systm.h>
Use MI rasops_cmap, instead of MD-defined ANSI colormap.

Note about workaround for 8bpp frame buffer:

Current LUNA wscons touches only first 4 planes (plane #0-#3), but
other program (e.g. mlterm-fb) can use all 8 planes on an 8bpp frame
buffer.  When such program exits, it may not clear all planes, so
there may be some visible garbage data on the other 4 planes (plane
#4-#7) when we use default 256 rasops_cmap directly.

We should manage all 8 planes on LUNA, but that will be too much
overhead for 16 colors wscons.  So, by repeating 16 colors in 256
colormap, we can ignore the values on the other 4 planes.

ok miod@
Switch to MI functions disk_{gone,openpart,closepart} instead of handrolling
the same functionality.
- use DL_SECTOBLK() instead of handrolling the same functionality
- octcfsize() returns daddr_t, so calculate the return value in a daddr_t
better warning for 8bit cards
remove unneccessary casts; Kent R. Spillner
Add initial httpd.conf(5) example for httpd(8)

Requested by deraadt@
use a better style of sh code around aperture
Repair two deep targets mistakenly called as afterinstall, rather
than distribution. These would modify files in /etc, part of the base
set, but still... that makes it harder to discern their sets placement.