Add additional safety check against invalid backup label file

It was already checking for invalid data after "BACKUP FROM", but
would possibly crash if "BACKUP FROM" was missing altogether.

found by Coverity
COPY: Add an assertion

This is for tools such as Coverity that don't know that the grammar
enforces that the case of not having a relation (but instead a query)
cannot happen in the FROM case.
Add missing va_end() calls

found by Coverity
Improve EncodeDateTime and EncodeTimeOnly APIs

Use an explicit argument to tell whether to include the time zone in
the output, rather than using some undocumented pointer magic.
Uppercase pg_upgrade status output title.
Remove unused tzn arguments for timestamp2tm()
Add const qualifier to tzn returned by timestamp2tm()

The tzn value might come from tm->tm_zone, which libc declares as
const, so it's prudent that the upper layers know about this as well.
sepgsql_setcon().

This is intended as infrastructure to allow sepgsql to cooperate with
connection pooling software, by allowing the effective security label
to be set for each new connection.

KaiGai Kohei, reviewed by Yeb Havinga.
Copy editing of sepgsql documentation.
A couple more fixes for the sepgsql documentation.
Add comments explaining why our Itanium spinlock implementation is safe.
Revisit handling of UNION ALL subqueries with non-Var output columns.

In commit 57664ed25e5dea117158a2e663c29e60b3546e1c I tried to fix a bug
reported by Teodor Sigaev by making non-simple-Var output columns distinct
(by wrapping their expressions with dummy PlaceHolderVar nodes).  This did
not work too well.  Commit b28ffd0fcc583c1811e5295279e7d4366c3cae6c fixed
some ensuing problems with matching to child indexes, but per a recent
report from Claus Stadler, constraint exclusion of UNION ALL subqueries was
still broken, because constant-simplification didn't handle the injected
PlaceHolderVars well either.  On reflection, the original patch was quite
misguided: there is no reason to expect that EquivalenceClass child members
will be distinct.  So instead of trying to make them so, we should ensure
that we can cope with the situation when they're not.

Accordingly, this patch reverts the code changes in the above-mentioned
commits (though the regression test cases they added stay).  Instead, I've
added assorted defenses to make sure that duplicate EC child members don't
cause any problems.  Teodor's original problem ("MergeAppend child's
targetlist doesn't match MergeAppend") is addressed more directly by
revising prepare_sort_from_pathkeys to let the parent MergeAppend's sort
list guide creation of each child's sort list.

In passing, get rid of add_sort_column; as far as I can tell, testing for
duplicate sort keys at this stage is dead code.  Certainly it doesn't
trigger often enough to be worth expending cycles on in ordinary queries.
And keeping the test would've greatly complicated the new logic in
prepare_sort_from_pathkeys, because comparing pathkey list entries against
a previous output array requires that we not skip any entries in the list.

Back-patch to 9.1, like the previous patches.  The only known issue in
this area that wasn't caused by the ill-advised previous patches was the
MergeAppend planning failure, which of course is not relevant before 9.1.
It's possible that we need some of the new defenses against duplicate child
EC entries in older branches, but until there's some clear evidence of that
I'm going to refrain from back-patching further.
Improve commentary in match_pathkeys_to_index().

For a little while there I thought match_pathkeys_to_index() was broken
because it wasn't trying to match index columns to pathkeys in order.
Actually that's correct, because GiST can support ordering operators
on any random collection of index columns, but it sure needs a comment.
backend: Fix minor memory leak in configuration file processing

Just for consistency with the other code paths.

found by Coverity
pg_restore: Fix memory and file descriptor leak with directory format

found by Coverity
pg_dump: Fix crash with invalid pg_cast row

An invalid combination of pg_cast.castfunc and pg_cast.castmethod
would result in a segmentation fault.  Now it prints a warning.

found by Coverity
psql: Remove inappropriate const qualifiers

Since mbvalidate() can alter the string it validates, having the
callers claim that the strings they accept are const is inappropriate.
libpq: Fix minor memory leaks

When using connection info arrays with a conninfo string in the dbname
slot, some memory would be leaked if an error occurred while
processing the following array slots.

found by Coverity
In pg_upgrade, create a script to incrementally generate more accurate
optimizer statistics so the cluster can be made available sooner.
Add note about column privilege behavior to REVOKE reference page

suggested by Josh Berkus