ssh: drop $FreeBSD$ from crypto/openssh

After we moved to git $FreeBSD$ is no longer expanded and serves no
purpose. Remove them from OpenSSH to reduce diffs against upstream.

Sponsored by: The FreeBSD Foundation

ssh: generate SK config file using private cbor and fido2 libs

Specify -lprivatecbor and -lprivatefido2 in OpenSSH's configure.ac, and
pass -I paths to libcbor and libfido2's contrib src location.

MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34440

ssh: correct configure option name

The option is security-key-builtin not security-key-internal. There is
no change to the generated config.h because the option defaults off
anyway.

MFC after: 3 days
Fixes: 87152f340549 ("ssh: disble internal security key...")
Sponsored by: The FreeBSD Foundation

ssh: disble internal security key support in generated config.h

We want to set ENABLE_SK_INTERNAL only when building with USB support.
We'll leave it off in config.h and enble it via our bespoke build's
Makefile.inc.

Sponsored by: The FreeBSD Foundation

openssh: disable libwrap (TCP wrappers) at configure time

We define LIBWRAP at build time in secure/usr.sbin/sshd/Makefile if
WITH_TCPWRAPPERS is in effect, so it should not be set in config.h.

MFC after: 1 week
Sponsored by: The FreeBSD Foundation

openssh: clarify krb5 use in freebsd-configure

freebsd-configure.sh runs configure twice, --with-kerberos5 and
--without-kerberos5, in order to build a config.h that defaults to
kerberos5 disabled, and a small config file that represents the
differences.

Rename config.h.orig to config.h.kerberos5 to clarify the intent of this
script.

MFC after: 1 week
Sponsored by: The FreeBSD Foundation

Try harder to sanitize the environment before running configure.
Remove a workaround for older Unbound versions that used sbrk.

Approved by: re (gjb)

Avoid picking up MIT Kerberos from ports (if installed).

Take care not to pick up the wrong version of OpenSSL when running in an
environment that has OpenSSL from ports in addition to the base version.

Now that we have local modifications in configure.ac and configure, run
autoheader and autoconf to avoid having to patch configure manually.

Unbreak the WITHOUT_KERBEROS build and try to reduce the odds of a
repeat performance by introducing a script that runs configure with and
without Kerberos, diffs the result and generates krb5_config.h, which
contains the preprocessor macros that need to be defined in the Kerberos
case and undefined otherwise.

Approved by: re (marius)