s4: bring nsupdate-gss into the s4 tree