Integrate DatalogGuard with Domain.

This commit adds support for DatalogGuards in a Domain. It also adds a simple
Save/Load test to make sure the domain loads the guard properly.
Add partial support for datalog authorization.

This commit is a WIP fix to get datalog support working in the Tao install
scripts. It still doesn't work, due to translation between auth statements and
datalog.
Fix basic datalog translation in DatalogGuard.

This commit fixes a bug in ReloadIfModified: the datalog engine was getting
cleared, but the assert method was skipping rules that already existed in the
database. So, after a ReloadIfModified, the rule set was right, but the datalog
engine was out of sync. This also adds a regression test for this case.
Add support for an "ext" type of auth principal.

An "ext" auth principal represents a set of free-floating extensions. It is used
to make statements like TrustedProgramHash(ext().Hash([9879a99bea0])), where the
initial part of the principal is not yet known.
Implement subprin/3 custom datalog primitive.

This commits gets subprin/3 to work with the new ext() auth.Prin type and adds a
test that uses subprin/3 to check authorization of a simple program running on a
trusted OS.
Add extra checks to catch invalid "ext" principals.

This commit adds checks to the core tao code to catch cases where "ext"
principals might appear. The goal is to prevent the code from panicking by
trying to operate on a nil Key value in the auth.Prin structure.
Fix the install script to work with DatalogGuard.

This commit fixes Datalog support in install.sh. It changes the auth statements
in install.sh to match the new Subprin custom datalog predicate subprin/3, and
it adds "ext()" prefixes to datalog statements that refer directly to principal
extensions.
Get datalog to work over the TPM.

This commit adds support for datalog authorization policies over the TPM and
gets the basic policy in install.sh to work. The problem with the version of the
subprin/3 principal before this commit was that it wasn't handling the quoted
strings correctly. This version outputs quoted strings as well as parsing
quoted-string principals in subprin/3.
Move utilities to tao_admin.

This commit moves getpcr and tpmprin into tao_admin and changes the install.sh
script to use tao_admin to get PCR values and the name of the TPM principal.
This also removes some superfluous debugging statements.
Clean up the top-level directory.

This commit moves the apps into an apps/ directory to clean up the top-level
directory.
Clean up the install.sh documentation.

This commit updates the documentation in install.sh to accurately describe the
current state of the Go implementation of CloudProxy.
Replace the "ext" principal type with PrinTail.

This commit removes the "ext" principal type and replaces it with a new Term
type called PrinTail. PrinTail represents a non-rooted sequence of extensions.
However, since it is not an auth.Prin, this commit removes all the now
superfluous checks about invalid "ext" principals where real principals are
required. This simplifies the code significantly while maintaining relatively
simple lexing/parsing behavior.

This commit also ports install.sh and the tests to the new "ext" PrinTail type.
Make the demo app use the domain Guard.

This commit changes the demo app from using the LiberalGuard for its tao-channel
authorization to using the Guard defined by tao.config and the associated rules.
Add support for a CA.

The Tao CA accepts TLS connections from programs, checks their attestations
according to its policy, and produces new attestations with new principal names
based in the policy key instead of names tied to hardware or a soft-Tao key. It
also provides an endorsement of the Program hash as a TrustedProgramHash; peers
add this predicate to their local policies so they can check authorization
against remote programs without keeping an up-to-date whitelist of valid hashes.

Note that the CA doesn't force peers to use its attestations: that depends on
the local policy in use by the peers. If peers choose not to accept CA
attestations and endorsements, then they call fall back on requiring full
hardware attestation chains, as in the current policy in install.sh.
Remove duplicate code and relocate docs.

This commit moves apps.txt into the Doc directory and removes file_server.go,
which duplicates the code of demo.go modulo spacing and comments.