Relative redirect is used almost everywhere, but to be honest
it looks safer to make all paths absolute.

PR: https://github.com/opnsense/core/issues/1168

PR: https://github.com/opnsense/core/issues/1168

PR: https://forum.opnsense.org/index.php?topic=3573.0

(openvpn) refactor openvpn_get_cipherlist and openvpn_get_digestlist, fix compatibilty with both --show-ciphers outputs

Suggested by: SimonB

Since we weaved the latter into the former, we can now get rid of
the transition code.  The behaviour doesn't change.

This does:

o Enable/disable all text as opposed to confusing icons of
  checkboxes.  Also mark them as "primary".
o Make the info button a pencil / edit button as we can modify
  data from there.
o Minor cleanups.

Missing:

o Removing the toggle buttons for each rule (the edit button
  is sufficient).  Haven't done this because the rowtoggle
  mechanism is probably better adapted by @adschellevis.
o Maybe move the enable disable all buttons back to the bottom.

There is no need to visually overload the field descriptions with
stop chars like a slash, the help is sufficient in explaining that
multiple networks can be used and the chances are high that most
will only ever use one network here.

Suggested by: SimonB via Pootle

Camellia can only be used with IKEv2

While there also get rid of the need for a /usr/ports dir (this will
make tools.git crash and burn for sure.)

shadow.ucl adapted from https://github.com/freebsd/freebsd-ports/blob/master/Keywords/sample.ucl

add camellia to cipher list

Required a little soft-coding in areas that could be thought of as
"pluggable" firewall rules.  It looks very doable for 17.7, we could
potentially make IPsec and OpenVPN plugins!  Or at least prove that
the plugin framework is capable of plugging in a complex VPN tech.

This looks simple enough now.  Discussed with @adschellevis.

Spotted by: @adschellevis

The array was still there, and even though empty evaluated as
being filled with data that requires an interface.

With the previous call-sites in place we don't need this
"fixup" anymore, assuming that interface groups, OpenVPN
and IPsec settings are now consistent under the new state,
which is true, because right now it was enforced by the
rc system anyway.

Phase 1 add/delete is the best call spot for this as it
defines a "physical" connection.

This wasn't completely right before, trying to plug into rules
reload paths and caused issues with people adding/deleting their
OpenVPN devices, but the rules tab not properly indicating this
since OpenVPN has become a pluggable interface.

(auth, totp) isolate TOTP functionality into a trait, refactor LocalTOTP. all needed for https://github.com/opnsense/core/issues/1030