Try compatible keys in rd_req_dec "any" path

When we go to decrypt a ticket using a keytab, we have two code paths.

In the first (traditional) one, we try to read an entry that exactly
matches the principal name, enctype, and kvno from the ticket, and then
attempt to decrypt the ticket using the entry's key.  The keytab
routines helpfully return an entry so long as it's of a key type that's
compatible with the ticket being decrypted, fixing up the enctype in the
entry structure while doing so, allowing us to decrypt a DES-CBC-CRC
ticket with a DES-CBC-MD5 key.

In the second code path, we try the key of every entry which loosely
matches the principal name from the ticket and which exactly matches its
enctype, meaning that the ticket/keytab pair above won't work if the
principal name is one which suggests we shouldn't be matching entries
exactly.

This change modifies the "any" path to also try to decrypt the ticket
with compatible keys.

[ghudson@mit.edu: avoid stuffing too much logic in one conditional]

ticket: 7883 (new)
Use portable transport enumerator for k5_sendto

In k5_sendto and k5_locate_server, replace "socktype" parameters with
a new enumerator k5_transport, so that we can add new transports which
are not in the socket type namespace.

[ghudson@mit.edu: renamed type to k5_transport; clarified commit
message]
[kaduk@mit.edu: use 'transport' for the name of variables of type k5_transport]
[nalin@redhat.com: update the test program]
Build support for HTTPS transport
Remaining cm read/write mutator functions
Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGE
Dispatch-style protocol switching for transport
HTTPS transport (Microsoft KKDCPP implementation)
Pull request comments, #1
Track the realm name for MS-KKDCP

Always pass a realm name to set_conn_state_msg_length(), to ensure that
we include the not-actually-optional target-domain field if we're using
MS-KKDCP.
Don't try to zero the byte after the buffer
Differentiate HTTPS and TCP trace messages
Remove a check on the kpasswd server's address

This test breaks when we're sending password changes over HTTP, and most
likely under NAT, too.
Add UTF8- and UCS4-to-punycode routines

Add k5int_ucs4_to_punycode and k5int_utf8_to_punycode and tests for the
first of them.  We'll need these to properly handle checking certificate
names which include international domain names.  Both the
implementations and test vectors are as close to RFC3492 as we can make
them.
Add http_anchors, _revoke, and _hostname settings

Add http_anchors, http_revoke, http_hostname and
http_require_crl_checking settings, mimicking both the locations and
effects of their similarly-named PKINIT counterparts, but affecting
HTTPS connections to KDC proxy servers.

The hostname checking aims to match behavior described in RFC6125.
Check for strtoul() correctly
Add a simple KDC proxy test server

This proxy server uses python-paste to run the kdcproxy from
https://pypi.python.org/pypi/kdcproxy.  It should be used along
with the proxy.pem certificate in ../tests/dejagnu/proxy-certs.
Add a test for MS-KKDCP client support