v0.2.1

Everything the first release listed as not fixed, fixed, and three
directives that were needed to do it: auth_ldap_resolver so a host in a
url is asked again rather than once, ssl_crl_file so a revoked
certificate is one, and ssl_check_cert chain so a certificate that names
something else can still be verified. Each of the seven has a check of its
own, and each check was held against the fix being taken out again.

What the first release of this fork wrote down as not fixed, fixed.

Fixed

• The bind DN that require valid_user "<dn>" builds is read as the
  distinguished name it is and bound as libldap writes it out again.
  Counting its commas was not enough: a login name with a plus in it builds
  one relative name with two values and leaves the count where it was.
• A value in a relative name that is written in the hexadecimal form a DN
  allows is refused, in a group rule as in a bind DN. The written form does
  not show the bytes it carries, a null byte among them, and libldap hands
  the decoded bytes on.
• A host in a url is asked again before every connection where
  auth_ldap_resolver says where to ask, so a directory that moved is
  reached without a reload. The addresses the configuration resolved used
  to be all there was.

Changed

• max_down_retries is counted for the connection and no longer for the
  server. With more than one connection they counted into the same number
  and one that came back reset it for all the others.
• The name in a certificate has to stand in a subject alternative name. It
  could come from the common name, which RFC 9525 says it should not, and
  nginx's own check still allows -- here it does not. Where that is the
  certificate one has, ssl_check_cert chain is the setting for it.

Added

• ssl_check_cert chain, a third setting between off and on: the chain
  is verified and the name is left alone, for a directory whose certificate
  names something other than the way it is reached.
• ssl_crl_file, a revocation list the certificate of the directory is held
  against.
• auth_ldap_resolver and auth_ldap_resolver_timeout, which say where a
  host in a url is asked of. A host that cannot be resolved while the
  configuration is read is an error without them and none with them.
• ci/resolve.sh and ci/dns.pl: a nameserver that answers from a file, so
  that the answer can be changed under a running nginx and the module can be
  asked whether it asked again.