Helper protocol upgrade: add optional kv-pair field to responses

This adds an optional kv-pair field immediately following the result field
on all helper interface responses. This field contains a list of key=value
pairs where the value is a RFC1738 (URL) encoded token or a quoted string.
Quoted-string MAY contain whitespace and shell escaping.

The response syntax for all helpers becomes:
  [channel-ID SP] result [SP key-pair ...] [SP other] EOL

The parser for HelperReply is also updated to map the old AF and NA
NTLM/Negotiate response fields into the HelperReply notes:
 * "token=" is added to supply the NTLM and Negotiate server blob/token.
 * "user=" is added to supply the user label field.
The relevant callback handlers are updated for these helpers to make use
of these new keys.

The bundled Digest authentication helpers are all upgraded to send the new
format responses. They now use ERR for failed lookup, BH for internal
errors, and OK with "ha1=" key added to supply a HA1 response. The handler
for Digest authentication is updated to process the new HelperReply fields
with failover the old format on Unknown result codes.

The external ACL handler is updated to pull its key=value pairs out of the
Notes list. The old parser loop becomes useless with this and is removed.
Taking with it support for several long deprecated keys "login=", "passwd=",
and "error=" which are now ignored.

Any other keys MAY be sent on any response. However at this stage 2 patch
they are ignored. As are repeated / secondary values for the expected key
names, only the first instance sent in the response is used.