When using KKDCP, load custom anchors and CRLs

Add http_anchors, http_revoke, and http_require_crl_checking settings
which we'll apply when using an HTTPS proxy, more or less mimicking the
locations and effects of their similarly-named PKINIT counterparts.
When using KKDCP, check the server's host name

When we connect to a KDC using an HTTPS proxy, check that the naming
information in the certificate matches the name we extracted from the
server URL in the configuration.
When using KKDCP, also match using "http_hostname"

When checking the naming information in a server certificate which we
receive when connecting to an HTTPS proxy, also accept the certificate
if it contains a name which matches a configured "http_hostname" value,
in an attempt to mimic to some extent the behavior we provide with the
"pkinit_kdc_hostname" setting.
Add a simple KDC proxy test server

This proxy server uses python-paste to run the kdcproxy from
https://pypi.python.org/pypi/kdcproxy.  It should be used along
with the proxy.pem certificate in ../tests/dejagnu/proxy-certs.
Add tests for MS-KKDCP client support

Exercise the MS-KKDCP client support using the test proxy server, for
AS, TGS, and kpasswd requests while also checking the certificate
verification and revocation and name checks.
Add some longer-form docs for HTTPS

Add some longer-form documentation for the new HTTPS support, walking a
prospective administrator through generating a bare minimal signing
setup, deploying a WSGI-based proxy server onto an Apache httpd server
using mod_ssl and mod_wsgi, and configuring clients to use it.