For uniformity with the serverutil package. Also, make error checking
on client TLS setup a bit stricter.

Just use backoff.Retry() straight away without a wrapper.

To match the previous calling convention for DoJSONHTTPRequest and
reduce confusion when migrating from the old API.

Implement a simpler API for the Backend interface, removing most old
public methods and replacing them with a single Call() method, making
the package look a bit more like an actual rpc package (so, hopefully,
easier to replace in the future).

Creation of sharded/replicated clients was swapped, sigh.

Encryption keys are stored themselves encrypted using a
password (kdf+aes-siv construction).

This package was moved over from git.autistici.org/id/keystore and
completely refactored.

The API makes it easier to set custom parameters on hashers. Default
Argon2 parameters were also set to defaults more suited for a
high-traffic authentication service.

Doh, don't know how this was missed until now.

Fixes include:
* only notify systemd after the network socket has been opened
* add net/http/pprof debug handlers
* add /health endpoint for Prometheus blackbox prober

Allows users to specify a set of trusted forwarders in the
configuration, and then using github.com/gorilla/handlers.ProxyHeaders
to rewrite the http.Request parameters according to X-Forwarding-* and
X-Real-IP headers.

Reduces cyclomatic complexity score and makes code more readable.

Before, we weren't releasing the connection properly.

Simply by setting an empty bind DN.

Supports multiple algorithms:
* system crypt
* scrypt
* argon2

We just made up new $something$ prefixes for the new algorithms.

Modeled to follow the net/http ResponseWriter.

Also simplifies handling of the connection pool itself, switching to
using deferred connects, and adds a test suite for misbehaving LDAP
servers to exercise failure modes.

Now the default is for errors to be permanent, unless the error itself
has a Temporary() method that returns true (like the transient network
errors do in the net/ package).

Code 429 is used by the server-side throttling code.