Update SCRAM dependency to 3.0 and support channel binding

[jorsol]

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

New Feature Submissions:

1. Does your submission pass tests?
2. Does ./gradlew styleCheck pass ?
3. Have you added your new test classes to an existing test suite in alphabetical order?

Changes to Existing Features:

• Does this break existing behaviour? If so please explain.
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?
• Have you successfully run tests with your changes locally?

[Neustradamus]

@jorsol: Good job!

Linked to:

• State of Play scram-sasl/info#1

[jorsol]

@davecramer this is passing tests, obviously the RPM build will fail until the scram 3.0 and stringprep 2.1 libraries are packaged for which I don't know who's in charge of that.

I see that the CI tests scram with and without SSL which should cover the channel binding, maybe a specific test is needed but I don't really have more time for this.

Also lacks documentation, maybe can be added later, in general "it should just work".

Not sure how this behave with pgbouncer or the like and there's no kill switch right now.

Another point to consider is the version to use, this could fit a minor version like 42.7.4 but at the same time I see more appropriate something like 42.8.0.

Please review and test when you can.

[vlsi]

If scram-* bundles the license file, we could probably remove customizations here, and remove /licenses/* files.
WDYT?

[jorsol]

Yes, it bundle the license now, not sure what exact does Gradle here, so if it's not needed to do anything else here, it could be probably removed.

[vlsi]

The configuration here sets to use license files from https://github.com/pgjdbc/pgjdbc/tree/master/licenses/scram for the scram library. Ideally, libraries should bundle their licenses (and the licenses of the shaded libraries as well), so in the ideal world, overrides should not be needed. However, previous scram versions missed the license files so we had to keep them in pgjdbc source tree

[jorsol]

Ouch!, I just checked that the stringprep dependency does not have bundled the LICENSE file, was completely an oversight, so we might need to keep the overrides a bit longer.

I will need to add a test to ensure this never happens in the future.