Coverity CID#469229

To address some Coverity pedentry with minor impact (at most)

CID#469230

Coverity CID#469233

Spotted by Coverity CID#469228, but it is irrelevant because only in
test code

Good catch by Coverity CID#469254

Coverity CID#469252

Ref Coverity CID#469262

The optimized case for multiple segments from the same fco did
not work as expected, continue did not continue the inner loop.

Spotted by Coverity, CID#469236

Coverity CID#469225

Ref CID#469268

Motivated by #41

the disk object is always a multiple of 4K, and for higher values (like
12K), rounding up to the next power of two does not make sense.

So, just use two allocations for FCO and FDO always.

For now, this uses a local installation of coverity's tools in the slink
subfolder.

As the fdr argument is from fbo->region, we should DTRT for this
situation and not bloat the code with a loop and stuff...

Motivated by #39

The code accepted the right pointer, the right offset _OR_ the right
size. Which lead to the wrong (usually the last) segment being freed.

Fixes #39

... in fellow_busy_obj_trimstore():

The code did not work correctly when the region was to be removed
(because it was reduced to size zero) _and_ it was not the last of the
regions.

Part of the fix for #39

assert that the FCS_BUSY segment to be trimmed is in fact contained in
the current body region.

The previous code

-       if (fdsl->nsegs == fcsl->lsegs ||
-           fcsl->segs[fdsl->nsegs].state == FCS_INIT) {

was confusing, it relied on the fact that, when an fcsl has more
segments than an fdsl, the first "surplus" segment has state FCS_INIT,
when it makes much more sense to just check fdsl->nsegs against
fdsl->lsegs.

This concerns an open issue from before the public release, which I
had not understood before and believe to have understood now.

With this code *) added to the test

@@ -5946,6 +5949,15 @@ t_cache(unsigned chksum)
	test_bocdone(fbo, TRUST_ME(hash), 1);
	fellow_cache_obj_deref(fc, fco);

+	// === max out region alloc
+	fbo = fellow_busy_obj_alloc(fc, &fco, &priv2, 1234).r.ptr;
+	CHECK_OBJ_NOTNULL(fbo, FELLOW_BUSY_MAGIC);
+	for (u = 0; u < FCO_MAX_REGIONS; u++)
+		AN(fellow_busy_region_alloc(fbo, 1234, INT8_MAX));
+
+	test_bocdone(fbo, TRUST_ME(hash), 1);
+	fellow_cache_obj_delete(fc, fco, hash);
+
	// === alloc space, dont use

we tripped here

   assert(flivs->oob || u == obj_alive);

with u == 1 and obj_alive == 0.

So the offset of a region from a dead object was not taken by a
subsequent allocation, which is fine, why should it be?

*) Note: The added test code is not correct yet, as it does not
   register the regions with the segment list, so obj_delete leaks.

This change should be semantically equivalent, but Flexelint understands
it.