Merge branch 'refs/heads/t/sha256'

A couple of changes which start to eliminate the use of sha1 in favor
of sha256. This series is only the first step, though, as we need to
keep sha1 for the time being to provide backward compatibility.

Cooking for four months.

* refs/heads/t/sha256:
  manual: Avoid sha1.
  upgrade_db: Add copyright and purpose to upgrade_db.c.
  web: Add link to the para_upgrade_db(1) man page.
  afs: Switch to sha256 and change default database path.
  Add para_upgrade_db.
  Use sha256 for the challenge response.
  Introduce hash2 (sha256).
  Assume sideband and aes_ctr128 are always supported/requested.