Apply patch, requested by tron in ticket #961:
external/ibm-public/postfix/dist/HISTORY patch
external/ibm-public/postfix/dist/RELEASE_NOTES patch
external/ibm-public/postfix/dist/src/global/mail_version.h patch
external/ibm-public/postfix/dist/src/local/forward.c patch
external/ibm-public/postfix/dist/src/tls/tls_client.c patch
external/ibm-public/postfix/dist/src/tls/tls_server.c patch

Update postfix to version 2.8.16:
- TLS Interoperability workaround: turn on SHA-2 digests by
  force. This improves interoperability with clients and servers that
  deploy SHA-2 digests without the required support for TLSv1.2-style
  digest negotiation.
- TLS Performance workaround: the Postfix SMTP server TLS session
  cache had become ineffective because recent OpenSSL versions enable
  session tickets by default, resulting in a different ticket
  encryption key for each smtpd(8) process. The workaround turns off
  session tickets. Postfix 2.11 will enable session tickets properly.
- TLS Interoperability workaround: Debian Exim versions before 4.80-3
  may fail to communicate with Postfix and possibly other MTAs, with
  the following Exim SMTP client error message:
  TLS error on connection to server-name [server-address]
  (gnutls_handshake):

The Diffie-Hellman prime sent by the server is not acceptable
(not long  enough)

  See the RELEASE_NOTES file for a Postfix SMTP server configuration
  workaround.
- Bugfix (defect introduced: 1997): memory leak while forwarding mail
  with the local(8) delivery agent, in code that handles a cleanup(8)
  server error.

(bouyer)