Port to python-gssapi

[frozencemetery]

As part of this, migrate any urllib2_kerberos code to urllib-gssapi.

Similar caveats to psss/python-nitrate#8 apply:

• The test suite for this tool cannot reasonably be run; see Test suite takes forever to run #146 and fedorahosted trac URLs attempted access during tests #145
• There are libraries (requests-gssapi, urllib-gssapi) that will speak this protocol for you. I'm happy to provide a patch for either of those if you would prefer. This package seems to already use urllib2-kerberos (which I have migrated to urllib-gssapi); I'm happy to migrate the remainder of the code to urllib-gssapi as well.

In Both here and in python-nitrate, you only perform one round of a SPNEGO handshake. This means that not all SPNEGO connections will complete - you never validate the server tokens, so mutual auth will always fail. I'm a bit surprised this works at all. Using requests-gssapi or urllib-gssapi will handle this problem for you.

[psss]

Thanks for providing the patch. The test suite should now be much better. Currently there does not seem to be python-urllib2-gssapi packaged for epel7. Could we use python2-requests-gssapi instead?

[psss]

I was able to make this working with requests_gssapi, but the mutual authentication has to be disabled for the Jira instace I test against. Any ideas for improvement welcome :) Current state merged into master.