http2: Deal with HTTP/2 data inside response header buffer

Previously if HTTP/2 traffic is appended to HTTP Upgrade response header
(thus they are in the same buffer), the trailing HTTP/2 traffic is not
processed and lost.  The appended data is most likely SETTINGS frame.
If it is lost, nghttp2 library complains server does not obey the HTTP/2
protocol and issues GOAWAY frame and curl eventually drops connection.
This commit fixes this problem and now trailing data is processed.
http2: fix switched macro when http2 is not enabled
RELEASE-NOTES: synced with 2ee3c63b13
cmake: fix NTLM detection and add krb5 feature

Based on recent configure patches:

    eda919f configure: Added krb5 to the supported features
    f0d860d configure: Fixed NTLM missing from features when CURL_DISABLE_HTTP defined
    fe0f896 configure: assume krb5 when gss-api works
    676d62f configure: Fixed inclusion of krb5 when CURL_DISABLE_CRYPTO_AUTH is defined

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
tests/test22: expand a backtick command

This is the only user of the backtick operator in the command. As the
commands will soon not be executed by a shell anymore (but by perl),
replace the command with its output.

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
runtests.pl: safer system() calls, fix LD_PRELOAD

Command invocation via runclient() (which calls system()) using a string
invokes the shell. This has the problem that tests which load
libhostname.so via LD_PRELOAD break when the library cannot be loaded
into the shell (when cURL is built with AddressSanitizer for example).

This patch removes the ability to use shell constructs in commands, such
as backticks, but fixes the above case where an ASAN-enabled library is
loaded with LD_PRELOAD.

The system call (in runclient) and backticks operator (for precheck) are
replaced by fork/open/exec to avoid executing sh. Note that sh is still
invoked when curl is built with shared libs in autotools due to the
libtool wrapper script.

Note for the curious: previously a gdb invocation would feed stdin via
'set args <input'. This only works because the command is interpreted as
a shell command. After this patch stdin is fed directly.

Detection of the `valgrind --tool` option was previously done by
invoking grep. Remove this use of grep. While at it, remove
`valgrind --version` invocation to determine whether `--log-file`
should be used instead of `--logfile`. Parse this information directly
from `valgrind --help` which was executed earlier.

As for differences in log file, these are just whitespace (trailing
space for `curl --version` command, spaces after redirection operator)
and quoting (quotes typically get stripped).

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
runtests.pl: simplify command environment handling

Rather than saving valid environment variables for restoration later,
use 'local' to limit the environment changes to the block executing
a command.

Rationale: LD_PRELOAD may not work with all executables. Previously
it would break on the shell when compiled with AddressSanitizer
(-fsanitize=address), but that is avoided by not executing string
commands anymore. gdb would still be executed with LD_PRELOAD though,
so setting $ENV in this way was not sustainable.

After this patch, environment variables are passed to executions of
precheck (for chkhostname), command (for curl) and postcheck (for
symmetry with precheck, it does not actually use it).

Note that this patch does not help with an autotools build which uses
shared libs and AddressSanitizer as the 'curl' program is a libtool
wrapper (shell script).

Signed-off-by: Peter Wu <peter@lekensteyn.nl>