also fix a memleak in an error path

the current status file for 1.1.9 is one of these

Move cryptography specific functions into their own file, together with
functions downloading public key / signatures
Factorize common code for generating signatures (hash_sha1_from_*)
Remove unused update_WaitDownload (was OSX specific)

(otherwise we would much more serious problems than the update checker)

directory: accepts any existing directory and will use the filename component of the update URL (old behaviour). This option no longer requires you to provide a string that ends with the pathsep.

filename: write directly to this filename. Existing files will be overwritten.

NULL: will write to filename component of the update URL. likely in the CWD.

1/ pgp v4 signature checks of status files with more than 506 bytes would fail
2/ pgp v4 signature checks would fail (code dupication sucks).

This code is quite a mess. We shouldn't need to implement all this lowlevel stuff. I'll remove most of it and use pgpme instead.

For the time being, this means that upcomming releases should use v3 signatures for the downloaded files and shouldn't use status files of more than 506 bytes (or maybe shouldn't use v4 signatures for status files either)

This fix also a crash because of a non joined thread on Mac OS X.

+ a few typo

This is not safe and not supported.

Note that _protocol abbreviations_ and friends are not localisable!

Should fixe #1635

Fix two potential segfaults.
Cosmetics.