This will be used as a simple way to lock down DRS replication to
administrators and domain controllers

Separate again the public from the private headers.

Add a new header specific for modules.
Also add service function for modules as now ldb_context and ldb_module are
opaque structures for them.

Rather than killing off the nasty 'kludge ACLs' stuff, this patch
extends it, to ensure that LSA secrets and the registry are also
protected.

Andrew Bartlett
(This used to be commit 2f2b110fb870132099bad1d4c16ed8962affb3ce)

(This used to be commit 566aa14139510788548a874e9213d91317f83ca9)

There are still a few tidyups of old FSF addresses to come (in both s3
and s4). More commits soon.
(This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)

Remove some autogenerated headers (which had prototypes now autogenerated by pidl)
Remove ndr_security.h from a few places - it's no longer necessary
(This used to be commit c19c2b51d3e1ad347120b06a22bda5ec586c22e8)

Make the ldb password_hash module only depend on some keys manipulation code, not full heimdal
Some other dependency fixes
(This used to be commit 5b3ab728edfc9cdd9eee16ad0fe6dfd4b5ced630)

- remove sid_active_in_token() was the same as security_token_has_sid()
- rename some functions

metze
(This used to be commit 81390dcda50f53d61e70059fb33014de0d283dc5)

the problem was that we shift with <<= (privilege-1)

and we called the function with privilege=0

add some checks to catch invalid privilege values
and hide the mask representation in privilege.c

metze
(This used to be commit a69f000324764bcd4cf420f2ecba1aca788258e4)