Dridi pointed out that there was still a colon missing to conform with
the SLT_Notice documentation in include/tbl/vsl_tags.h

Spotted by Coverity.

seen in vtest:

**** v1   vsl|       1004 Begin           b bereq 1003 fetch
**** v1   vsl|       1004 VCL_use         b vcl1
**** v1   vsl|       1004 Timestamp       b Start: 1602334643.946723 0.000000 0.000000
**** v1   vsl|       1004 BereqMethod     b PUT
**** v1   vsl|       1004 BereqURL        b /2
**** v1   vsl|       1004 BereqProtocol   b HTTP/1.1
**** v1   vsl|       1004 BereqHeader     b Host: 127.0.0.1
**** v1   vsl|       1004 BereqHeader     b Content-Length: 250000
**** v1   vsl|       1004 BereqHeader     b X-Forwarded-For: 127.0.0.1
**** v1   vsl|       1004 BereqMethod     b GET
**** v1   vsl|       1004 BereqHeader     b Accept-Encoding: gzip
**** v1   vsl|       1004 BereqHeader     b X-Varnish: 1004
**** v1   vsl|       1004 VCL_call        b BACKEND_FETCH
**** v1   vsl|       1004 VCL_return      b fetch
**** v1   vsl|       1004 BackendOpen     b 26 s1 127.0.0.1 36579 127.0.0.1 60878 connect
**** v1   vsl|       1004 Timestamp       b Bereq: 1602334643.956883 0.010159 0.010159
**** v1   vsl|       1004 FetchError      b HTC eof (-1)

Ref #3433

noticed by Dridi here:
https://github.com/varnishcache/varnish-cache/pull/3434/commits/f9f40b991f301fb96d2e2d0d52b86c3d4b1f9f7f#r502302785

The reference count returned already is an unsigned value

Test case by Reza, thank you

Fixes #3433
Closes #3434

SLT_Notice requires messages to be prefixed by the vmod name. Using this
format for notices only would appear inconsistent, so we change all
shard log messages to that format.

Making use of the PRIV_TASK `.free()` callback, we can finalize the
reconfiguration when the tasks ends, in case `.reconfigure()` has not
been called explicitly. o/ Dridi

Also turn `SLT_Error` `"(notice)"` logs into `SLT_Notice`.

This cursor is the simplest of all as of now, and also the fastest way
to skim through a -r input when it's a regular file. This is essentially
a file cursor with much less memory churn.

On a 13GB log dump captured during a performance benchmark varnishlog
takes around 6m15s to print all the transactions to /dev/null but the
mmap cursor consistently reduces this time to around 1m01s.

This is particularly useful to audit logs at rest, be it error logs
after an incident or transactions captured during a benchmark-type
scenario.

The shard director had the limitation to only support adding/removing
backends of one instance before `.reconfigure()` on that instance had
to be called, then the next instance could be changed.

This limitation came from the time when it was still unclear that
calling `VRT_priv_task()` on a per-object pointer was the accepted
interface for per-instance privs (varnish historians' recommended read:
https://github.com/varnishcache/varnish-cache/wiki/VIP1:-PRIV_*-visibility-and-lifetime-control
)

It is about time to lift that limitation now. o/ Dridi

Ref #3407

We now validate all header set operations to conform with the allowed
characters by RFC7230:

* HTAB 0x09
* VCHAR 0x20 to 0x7e
* obs-text 0x80 to 0xff

Ref https://httpwg.org/specs/rfc7230.html#header.fields

See #3407

I accidentally committed an earlier, wrong version. o/ Dridi

Ref #3407

https://github.com/varnishcache/varnish-cache/pull/3407#issuecomment-696146625

Ref: https://httpwg.org/specs/rfc7230.html#header.fields

  field-value    = *( field-content / obs-fold )
  field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
  field-vchar    = VCHAR / obs-text

- we do not accept the obsolete line folding (obs-fold)
- VCHAR is 0x20 to 0x7e
- obs-text is 0x80 to 0xff

So we end up with !VCT_CTL || HTAB (LF)

This change would be the basis for new use cases, like

- a type method .valid_header
- a feature flag +validate_headers which would call VRT_ValidHdr
  for all SetHdr calls

Spotted by Martin.

It makes it easier to substitute the hash director with say, the round
robin director, when weight is not a concern.

This only concerns VDP_END at esi_level > 0, which I considered not
relevant until Martin pointed out that it is.

the sole purpose is to ensure that we send a VDP_END.

Later, we might consider to arm the assertion in VDP_Close(). At this
point, a couple of VTCs fail. We would need to at least improve error
handling.

... to the extent possible today. See comment in the VTC for more
background.

Ref Martin's comments in #3298

de6288cb was incorrect in that it could
generate multiple VDP_ENDs, which did not show up during testing because
of the buffer being large enough to fit any testcase.

Make sure such issues pop up with rot13 testing by using a deliberately
minuscule buffer.

(and, yeah, we could take it from workspace, but the point is to
 demonstrate and test VDPs...)

It added a random byte.

We use the `final` argument in object iteration to denote
`OC_F_PRIVATE | OC_F_HFM | OC_F_HFP`.

As we now have `VDP_END` to mark the final bit of data, so should the
iterator flag be named `_END`. This also parallels `VDP_FLUSH` vs.
`OBJ_ITER_FLUSH`.

Supported by martin

Ref #3298

sigsegv_handler is on by default since 2015, ref
1955e460

noticed via argv dump in panic d0e986a6

This is solely to make bug reports more useful

Some browsers are strict about this and simply drop responses containing
such headers. Since this is not filtering a context switch between a
client and a backend transaction (or cache hit) a new filtering flag is
added to the HTTP headers table for connection-specific headers. This
new flag cannot be compounded as HTTPH_R_FETCH|HTTPH_A_INS because the
TE header is an exception and left alone, even though trailers aren't
supported.

Better diff with the --ignore-all-space option.

We could go further and consider any client request containing one as
malformed as mandated by RFC 7540.

Closes #3416