retrieve peer cert for an active TLS session

Add LDAP_OPT_X_TLS_VERSION / LDAP_OPT_X_TLS_CIPHER for
retrieving from an LDAP session handle. Update ldap_get_option(3).

Writer threads do their own wait using select/poll instead of
asking the listener thread. Eliminates one mutex+one condvar
per conn plus multiple wakeups of the listener thread. Also
fixes writetimeout to wait an exact time, instead of the
approximation used in the listener thread.

Note: I could not test the MozNSS patch due to the absence of
NSS PEM support on my machine. Given the review comments in
https://bugzilla.mozilla.org/show_bug.cgi?id=402712 I doubt that
trustworthy PEM support will be appearing for MozNSS any time soon.

GnuTLS does an implicit free on failure.

Ben Jencks authored Jan 27, 2013 and Howard Chu committed Sep 07, 2013

Update docs to reflect changes in handling and fix some errors.

The patch unconditionally enabled DHparams, which is a significant
change of behavior. Reverting to previous behavior, which only enables
DH use if a DHparam file was configured.

Ben Jencks authored Jan 27, 2013 and Howard Chu committed Sep 07, 2013

If a DHParamFile or olcDHParamFile is specified, then it will be used,
otherwise a hardcoded 1024 bit parameter will be used. This allows the use of
larger parameters; previously only 512 or 1024 bit parameters would ever be
used.

Ben Jencks authored Jan 27, 2013 and Howard Chu committed Sep 07, 2013

If a DHParamFile or olcDHParamFile is specified then it will be loaded. This
allows use of DHE/EDH cipher suites which was previously impossible with
GnuTLS.

Reset delete flag in cursor_put().

If so, don't advance cursor on next NEXT. Also, init xcursor
on the next GET_CURRENT.

Allow dynamic reconfig

Otherwise this is a no-op in various NOSYNC/MAPASYNC situations

The caller is responsible for making sure no transactions are
active in this process before resizing. This is slightly lighter
weight than doing a full env_close/env_open cycle.