spnego_gssapi: implement TLS channel bindings for openssl

[Foorack]

Channel Bindings are used to tie the session context to a specific TLS channel. This is to provide additional proof of valid identity, mitigating authentication relay attacks.

Major web servers have the ability to require (None/Accept/Require) GSSAPI channel binding, rendering Curl unable to connect to such websites unless support for channel bindings is implemented.

IIS calls this feature Extended Protection (EPA), which is used in Enterprise environments using Kerberos for authentication.

This change require krb5 >= 1.19, otherwise channel bindings won't be forwarded through SPNEGO.

[Foorack]

"Linux / hyper" CI failed during install hyper step, due to compile error in Hyper and was fixed in hyperium/hyper@4d0c184

[Foorack]

Rebased to bring PR up-to-date with master due to time passed.

Minor changes

• ossl_ssl_backend_data had in upstream been renamed to ossl_ctx, and ->handle to ->ssl
• changed u_char* to unsigned char* to be in line with rest of project

[Foorack]

Reverted Explicit Fetching implementation, for now, in order to be in-line with the rest of CURL source code. Potential migration from Implicit to Explicit Fetching is outside the scope of this specific PR.

Also resolved merge conflicts to keep branch up-to-date.

[Foorack]

@bagder We've been running this change in Production on hundreds of clients for several months, and it's been working great. What is the next step for this to be merged?

[Foorack]

Some tests failed because Launchpad was temporarily down.

[Foorack]

All tests pass now!

[MarcelRaad]

Looks good to me, thanks! It's a pity that nothing can be shared with the existing SSPI implementation as that's based on SSPI-specific types. I would appreciate more reviews from others interested in the topic (not necessarily curl maintainers).

[bagder]

Thanks!