merge security fixes from xorg-server 21.1.9 into xorg-server 10.

Fixes CVE-2023-5367 and CVE-2023-5380.

port to xorg-server 1.10:

apply
https://cgit.freedesktop.org/xorg/xserver/commit/?id=957e8db38f27932d353e86e9aa69cf16778b18f1

--
Use arc4random_buf(3) if available to generate cookies.

Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
--

port to xorg-server 1.10:
--
Log Message:
apply
https://cgit.freedesktop.org/xorg/xserver/commit/?id=2855f759b1e7bf7f5e57cac36c1f0d0e5ac1a683

auth: remove AuthToIDFunc and associated functions. Not used anymore.
And the current code for MitToId has a use-after-free() issue.

[Also remove the actual implementations - ajax]

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
--

initial import of existing netbsd xorg-server 1.10 sources in the
xorg-server.old subdir.