It is not obvious how we could trigger a gmtime_r() EOVERFLOW on 32bit

Thank you phk for pushing me back onto the right track at a late hour.

Ref #3308

as per pow-wow decision

Ref #3308

For VCL_TIME values that would convert to a year element that can not fit
in an int, gmtime_r would fail, and VTIM_format() would use random stack
values when picking weekday and month strings.

This patch changes VTIM_format to return "" when gmtime_r reports
failures. This way the API is not changed. Callers can test for empty
string to catch the failure if needed.

VRT_TIME_string is patched to catch the VTIM_format error, and return NULL
on failure.

Fixes: #3308

The new -j flag for varnishncsa allows writing JSON logs in combination
with -f or -F to specify a custom format. Without -j, the format
specifiers could be replaced with strings that would make the JSON
invalid.

One example is headers: without -j, some headers may be replaced with
C-style \xXX escape sequences, which are not valid JSON. Since request
headers are controlled by users on the internet, it would be easy for an
attacker to make a log entry impossible to parse, which might cause it
to be missed by administrators. Another example is numbers. Without -j,
format specifiers are replaced with - if the value is empty. A bare - is
not valid in JSON, so numbers are replaced with null with the -j flag.

In general, -j makes the replacements JSON-compatible for all inputs.
Co-authored-by: Ben Zvan <ben.zvan@target.com>
Co-authored-by: Jasmine Wang <jasmine.wang@target.com>
Co-authored-by: Jordan Christiansen <jordan.christiansen@target.com>
Co-authored-by: Madhavi Dintakurthy <madhavi.dintakurthy@target.com>

I'm leaving ctx alone because it is effectively checked.

It's otherwise too tight for for varnishstat's default refresh rate,
possibly for varnishhist and varnishtop too.

Spotted by: ubsan

Spotted by @cperciva

Why is it that a git push triggers a fresh look at the code?

Ref #3602

... following the example of Apache HTTP Server, see
http://httpd.apache.org/docs/current/mod/mod_log_config.html

Closes #3597

As we can safely regard (struct format).time_type is a private contract
between addf_time() and format_time(), use it to specify the exact
format type, which moves strcmp() parsing from execution to setup.

We now accept braces as long as they come in balanced pairs. As for now,
might only be useful with %{X}t.

Also extend testing of %{X}t and %{X}T

IIUC, the (c) has no meaning.

Ref: https://www.copyright.gov/circs/circ03.pdf

When admin commands control health, we report the timestamp of that
override operation.

When probing controls health, we report the timestamp of last
probing state change.

Otherwise, we report the timestamp of last admin health command.

expose it in the public side of the API so the backend layer
can get at it.

Fixes #3596

Closes #3574

Technically it can also happen with a debugger attached to a process
despite SA_RESTART.

... on my machine.

It was either this or adding a suppression for lsan.

Spotted by lsan.