gpg-agent: Add restricted connection feature.

* agent/agent.h (opt): Add field extra_socket.
(server_control_s): Add field restricted.
* agent/command.c: Check restricted flag on many commands.
* agent/gpg-agent.c (oExtraSocket): New.
(opts): Add option --extra-socket.
(socket_name_extra): New.
(cleanup): Cleanup that socket name.
(main): Implement oExtraSocket.
(create_socket_name): Add arg homedir and change all callers.
(create_server_socket): Rename arg is_ssh to primary and change
callers.
(start_connection_thread): Take ctrl as arg.
(start_connection_thread_std): New.
(start_connection_thread_extra): New.
(handle_connections): Add arg listen_fd_extra and replace the
connection starting code by parameterized loop.
* common/asshelp.c (start_new_gpg_agent): Detect the use of the
restricted mode and don't fail on sending the pinentry environment.

* common/util.h (GPG_ERR_FORBIDDEN): New.

agent/agent.h

@@ -130,6 +130,11 @@ struct
 
   /* This global option enables the ssh-agent subsystem.  */
   int ssh_support;
+
+  /* This global options indicates the use of an extra socket. Note
+     that we use a hack for cleanup handling in gpg-agent.c: If the
+     value is less than 2 the name has not yet been malloced. */
+  int extra_socket;
 } opt;
 
 
@@ -171,6 +176,9 @@ struct server_control_s
     gnupg_fd_t fd;
   } thread_startup;
 
+  /* Flag indicating the connection is run in restricted mode.  */
+  int restricted;
+
   /* Private data of the server (command.c). */
   struct server_local_s *server_local;