Add GSSAPI (Kerberos) authentication and GSS encryption

[quinnj]

Summary

Kerberos support for Postgres.jl through the operating system's GSSAPI library (the same library libpq uses), with no new binary dependency. Mechanism bindings come from registered SASLAuth 1.1.0; this PR is the protocol side.

GSSAPI authentication (auth codes 7, 8, 9): the gss_init_sec_context token exchange with GSSResponse messages, mutual authentication required (an AuthenticationOk before the context completes is refused). New options krbsrvname (default postgres) and gssdelegation, plus PGKRBSRVNAME / PGGSSDELEGATION.

GSS encryption (gssencmode: disable (default), prefer, require; PGGSSENCMODE): GSSENCRequest before SSLRequest, only when a ticket can be acquired; framed handshake; every message gss_wraped and chunked under the 16 KiB packet limit through a new API.GSSConn transport; N falls through to sslmode under prefer; a GSS attempt the server accepted but that then fails is retried once without GSS under prefer, as libpq does. cancel_query! uses GSS encryption when the connection it cancels does. Message flow, limits, and error texts mirror libpq's fe-auth.c / fe-secure-gssapi.c / fe-connect.c.

CVE-2024-10977 pattern: the server's ErrorResponse to SSLRequest (existing path) or GSSENCRequest (new) is no longer read or shown; the connection fails with libpq's fixed message.

Also: the keyword constructor now defaults user to the OS login name (PGUSER / USER / USERNAME), as the DSN path already did, so Postgres.Connection(host=...) works for ticket holders.

Design notes

• gssencmode defaults to disable rather than libpq's prefer: prefer would silently replace TLS with GSS encryption for anyone holding a ticket. Documented in the support policy.
• API.GSSConn.ctx is the concrete SASLAuth.GSSAPI.Context, as requested in review. The scripted protocol tests replace native entry points temporarily and use real Context objects; they restore system-library lookup before the live Kerberos fixtures.
• CI and documentation use the registered SASLAuth package. All temporary branch installs are removed; the compatibility floor is 1.1.0.
• The merge with main preserves startup options across plain, TLS, and GSS connections and reconnects. The release version is 2.1.0.

Test plan

• test/gssapi.jl: scripted native GSS entry points plus a scripted server on a loopback port cover G/N/E negotiation for prefer and require, the framed handshake, chunked framing both ways, the prefer re-dial, startup errors over GSS, no-credential behavior, auth codes 7/8/9 incl. premature AuthenticationOk, server rejection, duplicate request, cancel over GSS, wait_for_notification deadlines on the GSS transport, and the SSLRequest E path. Runs on every CI platform.
• Kerberos Fixture (Linux Docker jobs): an MIT KDC inside the PostgreSQL container, hostgssenc and hostnogssenc rules, real GSSAPI authentication and GSS encryption verified through pg_stat_gssapi, 100 KB results and 70 KB parameters across packets, cancel over GSS, and unknown-principal failures. Passed locally on macOS (Heimdal client) against Docker.
• Full suite passed locally on Julia 1.12 with Docker integration required: 6,226 checks, including live Kerberos, TLS, startup options, and the concrete-context regression. The SASLAuth source tree matches the registered release.
• All 16 checks passed on c9c190d: Julia/platform matrix, PostgreSQL 14–18, both authentication modes, documentation, and coverage. CI uses registered SASLAuth 1.1.0.

🤖 Generated with Claude Code

Co-authored by Codex