This prevents a linking error since ntp_dispatch_imsg calls
constraint_reset().

- add closefrom fallback for OS X / Linux systems, extracted from sudo,
but without the optimized versions, since they cannot work in a
chroot environment (and we're not performance critical here.)
- enable detecting libtls
- conditionally enable https constraint support

Well, support may be too concrete of a term. There is a lot that is
missing in OS X, and not everything can be implemented with portability
shims. The time APIs in OS X seem to have frozen with NeXTSTEP and never
advanced with POSIX.