mention that --dry-run isn't quite read-only
flip inclusion hierarchy of generated proxy driver source
Replace use of deprecated SecKeychain API
Add no-fail Core Foundation wrappers
Segregate macOS-specific keychain code
Add IncludeCmd directive to config parser
Refactor printing configuration errors
add support for single-quoting to our printf implementation