Make use of the new hsh_deref_objhead_unlock() in HSH_Lookup() to reduce
the number of times the objhead mutex is taken during cache hits.

Split hsh_deref_objhead() into two parts, with the new
hsh_deref_objhead_unlock() function expecting a locked objhead reference
on input.

Make this function lower case for consistency.

This changes the hash slingers deref function to take a locked objhead on
input, and unlocking it before returning. This saves a lock/unlock
sequence for critbit (which is the critical one) on HSH_DerefObjHead.

Move the clean up call to HSH_DeleteObjHead inside of the hash deref
methods that require it, instead of having the outside (single) caller do
it based off the return value. This just cleans up and makes the logic
more transparent.

This is caught by

	assert(lr == HSH_HIT || lr == HSH_GRACE);

in cnt_lookup()

Closes #2743

Conflicts:
	doc/changes.rst

doc/changes.rst was considered binary in master, it won't be in 6.0 so
there will be no need to pick a1d2db69
too.

Refs a1d2db69

in particular, move logging

they are the same case

Now that we got hit-for-pass (hfp) and hit-for-miss (hfm), we should
name the latter consistently to avoid unnecessary confusion

Conflicts:
	lib/libvarnishapi/vsl_arg.c

For some reason it was missing errno.h...

A vmod may return a null IP. This relaxes the check in VRT_acl_match to
fail the transaction instead of crashing.

Refs #2842

Inclused re-declaration fixes for some places which I got wrong in the
past.

Conflicts:
	bin/varnishd/cache/cache_objhead.h

This is a squashed commit including lint removal and formatting
suggested by @nigoroll.

The vmod name got lost in e7c04974

example before/after diff:

- new xshard_param = shard_param()
+ new xshard_param = directors.shard_param()

Partially addresses #2846. I've avoided mentioning NULL on purpose as
it's not really meaningful nor accessible from VCL. ymmv.

Pedantic back-port note: those are acronyms.

Add tests for vcl_keep and move vmod_so_keep together.
Reported and diagnosed by jw @ irc.

Enabled when using varnishtest -L.

this would have caught 7395ecae

Other polish.

$Module description, and suggest people to do it that way.

Make reporting syntax errors easier.

This adds rate limiting to varnishncsa and varnishlog.

Rate limiting is done on a per-transaction basis, respective to the
grouping mode selected. I.e. for -g request the limit will apply on a
per-request basis, -g raw on a per-record basis, etc.

Rate limit is specified as -R <limit>[/duration]. Default period if not
specified is seconds ('s').

This adds a ctx->handling test at the beginning of any compound
statement, to catch the cases where VRT_fail was invoked as part of an
if test condition.

Fixes: #2840

This may break out of tree code not respecting include order of vdef.h
first (or via cache/cache.h). It's trivial to fix and forces consumers
to follow the tracks.

Refs #2791