This is used to ensure that the time is written to the RTC when it is
synced. Problem noticed and patched by Christian Weisgerber.

- add closefrom fallback for OS X / Linux systems, extracted from sudo,
but without the optimized versions, since they cannot work in a
chroot environment (and we're not performance critical here.)
- enable detecting libtls
- conditionally enable https constraint support

Layout build machinery closer to LibreSSL to make code sharing easier.
Split the big Makefile.am into src/compat.