Modernize iprop code

* Don't use "extern" for kdb_log.h prototypes.
* Avoid passing structures by value.
* Avoid the need to cast the result of the INDEX macro, and use char *
  instead of unsigned long for pointer arithmetic.
* Reorganize kdb_log.c so static helpers are at the top and don't use
  the "ulog_" prefix.
* Get rid of ulog_finish_update_slave since it's more concise to
  open-code it in ulog_replay.
* Get rid of ulog_delete_update.  In krb5_db_delete_principal, just
  call ulog_add_update with kdb_deleted set in upd.
* Modernize coding style of kproplog.c.  Use k5memdup0 instead of
  snprintf in print_str to convert a byte range to a C string.
  Remove an unnecesary textdomain call; libkrb5 takes care of calling
  bindtextdomain in the library initializer.
* Modernize coding style of kpropd.c and kprop.c.

No functional changes.
Clean up ovsec_kadmd.c

Fix code formatting issues.  Use static scope when possible, and put
all helper functions before main so that forward declarations aren't
needed.  Use GSS_KRB5_NT_PRINCIPAL_NAME instead of constructing it
with gss_str_to_oid, and get rid of display_status as that was the
only use.  Replace large verbose function comments with concise ones.
Factor out main loop setup and KDB keytab setup into helper functions.
Create a helper function fail_to_start for logging and exiting on
initialization failures, and use it instead of the large cleanup
blocks in main.

Some initialization error messages have changed; no other functional
changes.
In kdb5_util load, init ulog closer to promote

Always map the ulog with FKCOMMAND, not FKLOAD which reinitializes the
ulog.  Don't reinitialize the ulog until just before calling
krb5_db_promote().  Get rid of FKLOAD since it isn't needed any more;
we can just call ulog_init_header() manually.
Don't get KDB lock in ulog_get_entries

ulog_get_entries does not access the KDB, only the ulog, so it does
not need a KDB lock; its read lock on the ulog is sufficient to
prevent logged updates from happening while it is running.  There is
no reason to serialize against unlogged KDB updates such as those
performed by the KDC, as those do not affect the ulog.
Properly reflect MS krb5 mech in SPNEGO acceptor

r25590 changed negotiate_mech() to return an alias into the acceptor's
mech set, with the unfortunate side effect of transforming the
erroneous Microsoft krb5 mech OID into the correct krb5 mech OID,
meaning that we answer with a different OID than the requested one.
Return an alias into the initiator's mech set instead, and store that
in mech_set field the SPNEGO context.  The acceptor code only uses
mech_set to hold the allocated storage pointed into by internal_mech,
so this change is safe.

ticket: 7858
target_version: 1.12.2
tags: pullup
Test SPNEGO acceptor response to MS krb5 mech OID

In t_spnego.c, add code to make a SPNEGO request with the erroneous
Microsoft OID value and examine the response to make sure that it uses
the same OID value as the request did.  The token and tmp variables
were unused, so rename them to itok and atok for the purpose of the
new test code.

ticket: 7858
target_version: 1.12.2
tags: pullup
Portable transport enumerator
Build support for HTTPS transport
Remaining cm read/write mutator functions
Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGE
Dispatch-style protocol switching for transport
HTTPS transport (Microsoft KKDCPP implementation)
Be more exacting about the reply content-length
Remove a check on the kpasswd server's address

This test breaks when we're sending password changes over HTTP, and most
likely under NAT, too.
Track the realm name for MS-KKDCP

Always pass a realm name to set_conn_state_msg_length(), to ensure that
we include the not-actually-optional target-domain field if we're using
MS-KKDCP.
Don't try to zero the byte after the buffer
Add http_anchors and http_revoke settings

Add http_anchors and http_revoke settings, mimicking both the locations
and effects of their similarly-named PKINIT counterparts, but affecting
HTTPS connections to KDC proxy servers.
Add an http_hostname option

Add an http_hostname option, though for now it only specifies alternate
CN values that we'd accept in the server's certificate's subject name
field.
Support dnsName subjectAltName hostname matching

Parse subjectAltName extensions when checking for a hostname match,
which also requires that we accept certificates without subject names.