We might read past the end of the workspace when no space was available
at reservation time. This would normally go unnotticed since we used to
get zeros after the end of workspace marker, and no assertion would
trigger. It became visible with the previous commit for pointer-aligned
workspace sizes like the current page-aligned default values.

Initially caught by wssan from #3320.

Fixes #3319

It might help catch more buffer overflows, although we still only check
the first byte.

The offset must be strictly lower than 0xffff, otherwise subsequent get
and set operations will ignore it. Instead of panicking, we release the
workspace and carry on if that happens.

This is only for correctness' sake, the probability to run into this is
epsilon.

From this point on, only cache_ws.c fiddles with struct ws, which needs
to remain visible in order to be embeddable in other data structures. We
have an API covering all use cases in tree, except vmod_vtc operations
that violate the contract to provide a rudimentary dump in VCL for test
purposes.

Inline functions provided in headers aren't considered a problem here.

The goal is to avoid direct field access inside struct ws outside of
cache_ws.c and open the possibility to perform a hexdump of a corrupted
allocation in the future, when wssan panics while checking red zones.

This effectively completes the ban of direct field access to the front,
start and reservation pointers outside of cache_ws.c, and since the
devil is in the details cache_http.c directly touches the id field and
vmod_vtc also accesses the 3 aforementioned pointers.

To accomodate the optimization for session attributes new functions are
added and with them extra checks.

With the same exceptions as the front pointer. For the cases where
actually need the value of the reservation pointer, I decided to
change the approach and make it a length computation instead, when
possible.

Proving that this always needed for use cases dealing with workspace
reservations.

Well, almost always, for now vmod_vtc and the panic subsystem are left
alone.

And add a companion function WS_ReservationSize(). This makes it explicit
that accessing the workspace front pointer is only valid for reservations,
and also informs you whether you are in the middle of a reservation, which
would be helpful for assertions.

Initially caught by wssan from #3320.

It may predate the use of a workspace reservation, and is ultimately
redundant.

Originally from #3320.

There is otherwise no valid use case to peek inside the workspace.

Only vmod_blob would grab the front pointer before making its
reservation, but ultimately grabbing the front pointer because it
needs it for a reservation, proving the point.

Initially caught by wssan from #3320.

Unlike WS_Alloc() it fills the allocated space with the result, which
should be considered constant at this point. And on top of that it's
a constant string and shouldn't be a void pointer.

up to d0a89676

Required fields work like inclusion filters, except that not matching
them doesn't have any consequence if no filter matched. They also take
precedence over regular filters.

Fixes #3394

They map directly to VSC 'I' and 'X' arguments.

And simplify the 'f' argument handling.

Instead we now have a single list that works on a first-match basis,
slightly changing the previous outcome where all exclusions were
checked before inclusions as illustrated by the u5 VTC.

To add insult to the injury the precedence of exclusive patterns over
inclusive patterns was documented backwards.

It is not limited to varnishstat.

concept, which will become more and more important.

Uncacheable and shortlived objects end up in transient memory. Add two
counters to track both type of responses separately.

This avoids a bogus message

	Could not rmdir 'vcl_...': Directory not empty

Ref 904659a1
    1594037c

For dynamic allocations use:

	VSB_new_auto() + VSB_destroy()

For preexisting buffers use:

	VSB_init() + VSB_fini()

VSB_new + VSB_delete are deprecated.