Use Notes objects for key=pair handling in HelperReply

Use Notes objects for key=pair handling in HelperReply

* NTLM/Negotiate auth are expeted to return OK/ERR/BH/TT codes and key=pair.
  The old result lines are still received, but converted to the new format
  silently.

* new key accepted:
 'token=' for passing NTLM and Negotiate auth tokens

* some undocumented old tags accepted by external_acl_type are now ignored:
 'error=' replaced by 'message='
 'passwd=' replaced by 'password='
 'login=' replaced by 'user='
These were replaced some time ago and never formally documented.