Unify how we check passwords between different OSes

make error message prefix consistent

increasing for loops are idiomatic

Localize running and failure inside readpw()

They are only needed there, so don't make them global.

Move screen unlocking inside cleanup()

Re-introduce the waiting loop for input grabbing

We actually “need” to wait a little for input to be released before
locking for cases where slock is spawned from other graphical
applications using keybindings.
This undoes the misbehaviour I introduced in c2f9757, sorry for the mess.

Add cleanup() to do free(locks) + XCloseDisplay()

Refactor dontkillme()

- Use file pointers instead of raw I/O, inspired by Kernel code.
- Use OOM_SCORE_ADJ_MIN from linux/oom.h instead of working with
  magic values.
- Stricter error checking and descriptive error messages.

The reasoning for using the constant rather than magic values lies
in the fact that this ensures people get the message.
With "-1000", a code reviewer would question if that is really the
lowest possible number or just an arbitrary value.
The kernel ABI probably won't change, but even in the case, we wouldn't
have to modify the code. The OOM killer only is guaranteed to not
kill you if you have OOM_SCORE_ADJ_MIN.

Convert manpage to mandoc and fix usage

In all honor, the previous usage was formally more correct, but for the
sake of consistency across all the tools having the v-flag, I separated
it from the command-string.

Also, make use of the mandoc macros for the manpage. This makes it
easier to maintain, extend and change in the future.

fix CVE-2016-6866

Update bsd-auth string.

Thanks to Hiltjo for discovering this.

Exit as soon as possible on input grabbing error

We want to know at once if slock failed or not to lock the screen, not
seing a black screen for a whole second (or two) and then die.
Thanks to ^7heo for reporting this.

Refactor main()

- Add arg.h and fix usage
	Given slock is suid we don't want to have half-measures in place to
	parse the arguments in case the code is changed in the future with
	somebody not paying enough attention.

	Also, fix the usage string output to be more consistent across the
	suckless toolbase and make it reflect the manpage entry.

- Comments
	Use proper block comments and add/change them where necessary
	to help in studying the code.

- Error messages
	Consistently prepend them with "slock:" and fix wording and
	do a proper cleanup before quitting (XCloseDisplay and free
	the locks), making the die() semantics consistent with st's.

- getpwuid() error reporting
	Properly present an error message if getpwuid() fails.

- fork() error reporting
	Properly present an error message if fork() fails. If we cannot
	close the connection within the fork context we abort the
	operation and report an error.

- execvp() error handling
	If execvp fails, we cannot call die() afterwards as this implies
	calling exit(). We must use _exit() to prevent the libc from
	doing now "illegal" cleanup-work.

clear passwords with explicit_bzero

Make sure to explicitly clear memory that is used for password input. memset
is often optimized out by the compiler.

Brought to attention by the OpenBSD community, see:
https://marc.info/?t=146989502600003&r=1&w=2
Thread subject: x11/slock: clear passwords with explicit_bzero

Changes:

- explicit_bzero.c import from libressl-portable.
- Makefile: add COMPATSRC for compatibility src.
- config.mk: add separate *BSD section in config.mk to simply uncomment it on
  these platforms.

Revert "No need for usage()"

This reverts most of commit a6dc051e3744ce5b14c54d2d246d3e8258207e76 and fixes
some related stuff:

- keep spelling fixes from original commit
- make -h and -v also work when followed by more arguments
- any unknown flag prints usage
- fix output of -v to display "slock: version 1.3" instead of "slock: slock-1.3"

revert using argv0 and minor fixup

- use hardcoded "slock" instead of argv[0]
- add "slock: " to fprintf calls, where it was missing
- revert `argc--, argv++` shifting

Use argv0 instead of passing "slock:" to die every time

No need for usage()

There are 2 arguments why -v and -h are broken:

	1) if you are running off git, -v will show the last stable
           release, effectively making this option useless.
           people running stable versions leave open an attack surface
           this way in case there are vulnerabilities found.
           99% of the people are also using package managers to keep
           their software up to date, instead of running $TOOL -v to
           check how old it is.
        2) -h is a sad excuse for not just looking at the manual page
           (man 1 slock). Given we accept a post_lock_command, we can't
           be as liberal and just intercept certain flags.

I changed the manpage to reflect this change.

Clarify config.def.h

Clear up the wording a bit and explain what failonclear means.

Simplify the oom-taming-function

There really is no need to source a defined variable from a linux
header. The OOM-rank ranges from -1000 to 1000, so we can safely
hardcode -1000, which is a sane thing to do given slock is suid and
we don't want to play around too much here anyway.

On another notice, let's not forget that this still is a shitty
heuristic. The OOM-killer still can kill us (thus I also changed
the wording in the error-message. We do not disable the OOM-killer,
we're just hiding.