heimdal: always confirm PA-PKINIT-KX for anon PKINIT

Import upstream 38c797e1a.

Upstream notes:

RFC8062 Section 7 requires verification of the PA-PKINIT-KX key
excahnge when anonymous PKINIT is used. Failure to do so can
permit an active attacker to become a man-in-the-middle.

Reported by: emaste
Obtained from: upstream 38c797e1a
Security: CVE-2019-12098
MFC after: 1 week

A new jail(8) with a configuration file, to replace the work currently done
by /etc/rc.d/jail.

Create the altix project branch. The altix project will add support
for the SGI Altix 350 to FreeBSD/ia64. The hardware used for porting
is a two-module system, consisting of a base compute module and a
CPU expansion module. SGI's NUMAFlex architecture can be an excellent
platform to test CPU affinity and NUMA-aware features in FreeBSD.

- Import the HEAD csup code which is the basis for the cvsmode work.

Fix conflicts after heimdal-1.1 import and add build infrastructure. Import
all non-style changes made by heimdal to our own libgssapi.

Vendor import of Heimdal 1.1

Resolve conflicts.

Import of Heimdal Kerberos from KTH repository circa 2002/09/16.

Resolve conflicts after import of Heimdal Kerberos circa 2002/08/29.

Import of Heimdal Kerberos from KTH repository circa 2002/08/29.

Resolve conflicts after import of Heimdal Kerberos 2002/02/17.

Import of Heimdal Kerberos from KTH repository circa 2002/02/17.

fix merges from 0.3f

import of heimdal 0.3f

nuke conflict markers

fix conflicts in heimdal 0.3e import

import of heimdal 0.3e

Merge conflicts.

Import KTH Heimdal, which will be the core of our Kerberos5.
Userland to follow.