new parameter max_challenge limits number of Access-Challenges

Force authentication failure when a certain amount of challenges
has been reached.
This is a workaround for buggy servers that keep issueing
challenges, when they should really send Access-Reject.
The limit is configurable through parameter "max_challenge".
The default is 0, which means the workaround is disabled.
An invalid or negative value also disables this workaround.