let private tor networks more reliably handle hidden services

this is a tweak on the fix in f87c6f100d (see also #2088)
Stop using MAX_PATH, it might not be defined

This broke compilation on Hurd
Script to generate ciphers.inc by Arturo
Make get_mozilla_ciphers script a little more regexy and readable
Have get_mozilla_ciphers take sourcedirs as arguments
Try to make get_mozilla_ciphers output the right macros in the right order
get_mozilla_ciphers: output lowercase hex.
get_mozilla_ciphers: look at ssl3con.c, not sslenum.c
fix for bug #5210: enable GCC and LD hardening by default
If DisableNetwork, don't even try to open non-controller listeners

Fix for 5604; bugfix on 0.2.3.9-alpha, which introduced DisableNetwork.
When downloading bridge descs from a bridge authority, always be anonymous
Close OR connections that send junk before AUTHORIZE/VERSIONS

Fix for 4369.
Refactor new getcwd code

Make sure that the "path_length *= 2" statement can't overflow.

Move the "malloc and getcwd" loop into its own function.
Raise thresholds for declaring bootstrapping complete.

This patch changes the total serverdesc threshold from 25% to 75%
and the exit threshold from 33% to 50%.  The goal is to make
initially constructed circuits less horrible, and to make initial
less awful (since fetching directory information in parallel with
whatever the user is trying to do can hurt their performance).

Implements ticket 3196.
Try to manually test for whether the compiler hardening flags work

Also, make the check for whether they're on by default work; there's
no need to mess around with this "$enableval" silliness.
Make the option-checker code work with osx clang

This is a matter of making gcc and friends squirm more loudly when
they get an option they don't like (-pedantic) and making clang shut
up with it gets an option it tolerates but doesnt know
(-Qunknown-argument).

Is there no better way?
An attempt at bug3940 and making AllowDotExit 0 work with MapAddress

This time, I follow grarpamp's suggestion and move the check for
.exit+AllowDotExit 0 to the top of connection_ap_rewrite_and_attach,
before any rewriting occurs.  This way, .exit addresses are
forbidden as they arrive from a socks connection or a DNSPort
request, and not otherwise.

It _is_ a little more complicated than that, though.  We need to
treat any .exit addresses whose source is TrackHostExits as meaning
that we can retry without that exit.  We also need to treat any
.exit address that comes from an AutomapHostsOnResolve operation as
user-provided (and thus forbidden if AllowDotExits==0), so that
transitioning from AllowDotExits==1 to AllowDotExits==0 will
actually turn off automapped .exit addresses.
Treat SW_SERVER_HELLO_B as another sign of an SSL handshake

We've been only treating SW_SERVER_HELLO_A as meaning that an SSL
handshake was happening.  But that's not right: if the initial
attempt to write a ServerHello fails, we would get a callback in
state SW_SERVER_HELLO_B instead.

(That's "instead" and not "in addition": any failed attempt to write
the hello will fail and cause the info callback not to get written.)

Fix for bug 4592; bugfix on 0.2.0.13-alpha.
Prevent an (impossible) null-pointer dereference in connection_edge_process_relay_cell

This would happen if the deliver window could become negative
because of an nonexistent connection.  (Fortunately, _that_ can't
occur, thanks to circuit_consider_sending_sendme.  Still, if we
change our windowing logic at all, we won't want this to become
triggerable.)  Fix for bug 5541.  Bugfix on 4a66865d, back from
0.0.2pre14.  asn found this.  Nice catch, asn!
Change our ciphersuite list to match ff8