securid: Add "paranoid" RNG option

If we're going to be issuing new tokens for production use, make sure
the keys come from a high quality entropy source.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
common: Call fclose() on read error

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
sdtid: Enhance XML utility functions

The lookup_* functions will now perform a recursive lookup in order to
handle the TokenAttributes node.  Fortunately every node in this document
format has a unique name so there are no conflicts.

Add a replace_string() function used to build new sdtid documents.

And add a node_present() function used to determine whether a field is
present in a template document.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
cli: Add infrastructure for new sdtid output commands

New commands are:

stoken issue [ --template=<FILE> ] [ --new-password=<PASSWORD> ]
stoken export --sdtid [ --template=<FILE> ]

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
sdtid: Split generate_keys() out of securid_decrypt_sdtid()

We need to generate keys for both decrypt and encrypt, so make it a
common function.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
sdtid: Allow parse_sdtid() to work in a "less strict" mode

Template files are allowed to be missing entire sections, so enable strict
mode for a real sdtid but disable it for "stoken issue --template=foo"

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
securid: Switch to the reentrant version of gmtime()

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
sdtid: "stoken issue" and "stoken export --sdtid" are functional

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>