v0.3.0

Test infrastructure: an in-memory FreeIPA server for unit tests, and the
same contract tests run nightly against real FreeIPA 4.9, 4.12 and 4.13.
The first real-server runs found a bug in UserAdd that dates back to
ubccr/goipa v0.0.7; it is fixed here.

• New package ipatest: a fake FreeIPA server over TLS for tests of code
  that uses goipa. NewServer(t) (or New() outside tests), Client,
  ClientAs, Session, seed and inspect users and OTP tokens, a call
  log (Calls) and Handle to inject errors or serve any command it
  does not model. It models user_show/find/add/mod/del/disable/enable,
  passwd, otptoken_add/del/mod/find, login_password and change_password
  with the lockout, expiry and last-OTP-token behaviour of FreeIPA 4.13;
  each quirk is listed in the package doc and pinned by a test
• (*IpaError).MarshalJSON writes FreeIPA's error shape
  (code, message, name, data); Data that is not JSON becomes {}
• Unit tests for the whole API against ipatest, coverage above 80 %
  (gated in CI) and Codecov upload
• Integration tests run nightly against FreeIPA 4.9.13, 4.12.2 and 4.13.4;
  the same contract tests run against ipatest and the real server. The
  integration tests are now named *_integration_test.go
• pkg.go.dev examples for the login modes and the RPC escape hatch
• Removed the CentOS 7 container/, docker-compose.yml and .env.sample;
  scripts/ipa-up.sh starts a FreeIPA container instead
• Testing with ipatest: it answers /ipa/json (the Kerberos endpoint)
  with 401 unless SetNegotiateUser is set, as a real server does for a
  client without a Kerberos ticket; log in with RemoteLogin or ClientAs
  instead
• UserAdd and UserAddWithPassword leave empty attributes out of
  user_add, so FreeIPA applies its defaults; an unset HomeDir failed
  with 4205 missing attribute "homeDirectory" (bug since v0.0.7)
• ipatest: JSON-RPC without a valid Referer gets HTTP 400 text/html like
  FreeIPA, not error 911; a MagBearerToken it did not issue closes the
  connection (goipa returns EOF), as the real server's httpd crashes on it
• ipatest models user_add with an empty homedirectory (4205, Q19)
• ipatest.Server.ExpireSession ends a session; calls with it get 401
  (ErrUnauthorized), as for an expired session on FreeIPA
• scripts/ipa-up.sh sets forwardable = true in krb5.conf; without it
  every Kerberos call fails 2100 "Credential cache is empty"
• Contract tests expect invalid-password for locked users before FreeIPA
  4.13.1 (FreeIPA issue 9891)