This is shared code used by id/auth, id/keystore, and others. Unifying
it into its own package helps prevent drift among implementations.

Allows for failover in case a target times out.

Trace requests on client and server HTTP traffic, using a system-wide
configuration file to control reporting.

And return the right error code (403, not 401).

For uniformity with the serverutil package. Also, make error checking
on client TLS setup a bit stricter.

Just use backoff.Retry() straight away without a wrapper.

To match the previous calling convention for DoJSONHTTPRequest and
reduce confusion when migrating from the old API.

Implement a simpler API for the Backend interface, removing most old
public methods and replacing them with a single Call() method, making
the package look a bit more like an actual rpc package (so, hopefully,
easier to replace in the future).

Creation of sharded/replicated clients was swapped, sigh.

Encryption keys are stored themselves encrypted using a
password (kdf+aes-siv construction).

This package was moved over from git.autistici.org/id/keystore and
completely refactored.

The API makes it easier to set custom parameters on hashers. Default
Argon2 parameters were also set to defaults more suited for a
high-traffic authentication service.

Doh, don't know how this was missed until now.

Fixes include:
* only notify systemd after the network socket has been opened
* add net/http/pprof debug handlers
* add /health endpoint for Prometheus blackbox prober

Allows users to specify a set of trusted forwarders in the
configuration, and then using github.com/gorilla/handlers.ProxyHeaders
to rewrite the http.Request parameters according to X-Forwarding-* and
X-Real-IP headers.

Reduces cyclomatic complexity score and makes code more readable.

Before, we weren't releasing the connection properly.

Simply by setting an empty bind DN.

Supports multiple algorithms:
* system crypt
* scrypt
* argon2

We just made up new $something$ prefixes for the new algorithms.