PR13667: Range checking for hooks and priorities

- Added more strict range checking for hook names
- Added support for arp and bridge netfilter hooks
- Added range checking of priority strings for ipv4
  and ipv6 hooks, numerical checking for all
PR13667: Added guru mode requirement for $verdict

guru mode is needed to write to $verdict, for obvious reasons
PR13667: Tweak verdict-needs-guru error message
PR13667: Fixed guru mode hook-not-defined bug

Before, when in guru mode, it would pass the hook/priority
strings across without checking/converting them to numbers. This
caused a bug where perfectly legal strings (such as NF_IP_PRE_ROUTING)
would be unrecognized in the generated code since their definitions
are not available in kernel space.

Now, it checks/converts all the strings to numbers whether in guru
mode or not, but only complains about mismatches if not in guru mode.
If in guru mode, it will still pass the initial string across if it
doesn't match anything else.
PR13667: Fixed probe point ordering

Now supports:

netfilter.hook().pf()
netfilter.pf().hook()
netfilter.hook().pf().priority()
netfilter.pf().hook().priority()

And .priority() no longer has a default value (i.e. it is
required).
Add testcase for PR14107 Bad user unwinding from kernel fatal signal handler.

This is really a kernel bug, see bug report, when the CFI for the assembly
code is missing we cannot properly recover the register state for the user
process and might give a bad/missing user backtrace.
tapset-netfilter.cxx compile fixes.

include limits.h for MAX_INT and MIN_INT, define NF_IP6_PRI_RAW if undefined.
More tapset-netfilter.cxx compile fixes.

Define NF_IP_PRI_SECURITY and NF_INET_PRE_ROUTING constants for pre 2.6.26
and pre 2.6.24 kernels.
unprivileged_probes.exp test both netfilter pf(string)/hook(string) variants.

Both netfilter.pf(string).hook(string) and netfilter.hook(string).pf(string)
are valid (plus priority).
unprivileged_probes.exp remove bare netfilter.hook(string) tests.

Bare netfilter.hook(string) is no longer valid, it always needs pf(string).
Basic test cases for primitive probe points defined in tapset-netfilter.cxx.

These are all ok/ko type build tests. Tests for actual use of the
functionality will be committed together with an improved netfilter.stp.

The failure of buildok/netfilter02.stp is currently due to a known bug
involving the definition of multiple netfilter probe points.
Initial version of improved tapset for netfilters.

This tapset exposes the ability to track IPv4 network packets using the
netfilter hooks mechanism. Support for IPv6 is still very patchy, and
support for other protocols (ARP, bridge) is basically nonexistent.
Simple netfilters example and sanitycheck.

This is an example script which uses netfilter hooks to count total
traffic over all source-destination pairs seen by the computer.
Fix to allow netfilters scripts to distinguish between ipv4 and ipv6 packets.
NEWS: mention pretty-printing changes
Regenerate examples index.
Added section describing netfilter probes to stapprobes.3stap.

Note that the link to tapset::netfilter (3stap) is currently broken.
That man page is waiting on a fix for PR14146. If that bug gets delayed
indefinitely, it may be necessary to delete the reference for the time
being, and refer people to the Tapset Reference document instead.
Initial (barely adequate) reference doc for netfilter.stp.
PR14137: tolerate duplicate netfilter hook probe handlers

translate.cxx may model duplicate probe handlers by changing multiple
*_derived_probe ->name's to the same string, which upsets
tapset-netfilter.cxx code generation.  Use an index for the contexts
where required.

* tapset-netfilter.cxx (netfilter_derived_probe ctor): Assign unique
  nf_filter index.
  (emit_module_decls, emit_module_init, emit_module_exit): Use when
  appropriate.
diagnostics: for stap -vv and above, print "focused on module <FOO>" messages

* tapsets.cxx (validate_module_elf): Be a touch more verbose about dwarf/elf
  modules elfutils found for us.