Security fix + lots of other fixes and improvements

This is an incremental update release with 1 minor security update, many small fixes and improvements.

• fix - security - rules blobs were breaking unlinkability between servers - thx @dnet!
• some updates to the docs
• fix - oracle didn't parse params
• alpn identifier now sphinx/1
• fix ltsigkeys of servers used now included in qrcode
• improved user messages

thanks to @stsch9 for contributions and @enjeck for help with the documentation.