Secure ICAP

Secure ICAP

This patch adds support for ICAP services that require SSL/TLS transport
connections. The same options used for the cache_peer directive are used for
the icap_service directive, with similar certificate validation logic.

To mark an ICAP service as "secure", use an "icaps://" service URI scheme when
listing your service via an icap_service directive. The industry is using a
"Secure ICAP" term, and Squid follows that convention, but "icaps" seems more
appropriate for a _scheme_ name.

Squid uses port 11344 for Secure ICAP by default, following another popular
proxy convention. The old 1344 default for plain ICAP ports has not changed.

Technical Details
==================

This patch:
  - Splits Ssl::PeerConnector class into Ssl::PeerConnector parent and two kids:
    Ssl::BlindPeerConnector, a basic SSL connector for cache_peers, and
    Ssl::PeekingPeerConnector, a peek-and-splice SSL connector for HTTP servers.

  - Adds a third Ssl::IcapPeerConnector kid to connect to Secure ICAP servers.

  - Fixes ErrorState class to avoid crashes on nil ErrorState::request member.
    (Ssl::IcapPeerConnector may generate an ErrorState with a nil request).

  - Modifies the ACL peername to use the Secure ICAP server name as value while
    connecting to an ICAP server. This is useful to make SSL certificate
    policies based on ICAP server name. However, this change is undocumented
    until we decide whether a dedicated ACL would be better.

This is a Measurement Factory project.