Log Message:
pkg_install-20170419:
- Convert to libarchive 3.x interfaces, avoiding the legacy glue.
- Rename local copy of netpgpverify to match installed headers.
- Shuffle bootstrap code to reduce special cases in pkg_add.
- Always read/write file names in tar archives as binary. While they are
  supposed to be UTF-8, locale conversion creates more problems than it
  solves here.
- Fix const correctness in gpg_verify.
- Add format string annotation for xasprintf for GCC-like compilers.
- Restrict supported archive formats for binary packages to ar (signed
  packages) and tar (actual content) with uncompressed/gzip/bzip2/xz as
  compression choices. This reduces the exposed libarchive surface.
- The pkg-vulnerability file correspondingly supports only the same
  compression choices.