MINOR: compression: optimize memLevel to improve byte rate

Decreasing the deflateInit2's memLevel parameter from 9 to 8 does not
affect the compression ratio and increases the compression speed by 12%.
Lower values do not increase transfer speed but decrease the compression
ratio so it looks like 8 is optimal.
BUG/MINOR: http: compression should consider all Accept-Encoding header values

Right now commit 82fe75c1 came with a minor bug limiting the check to the first
accept-encoding header value only.
BUILD: fix coexistence of openssl and zlib

The crappy zlib and openssl libs both define a free_func as a different typedef.
That's a very clever idea to use such a generic name in general purpose libraries,
really... The zlib one is easier to redefine than openssl's, so let's only fix this
one.
MINOR: conf: rename all ssl modules fetches using prefix 'ssl_fc' and 'ssl_c'

SSL fetches were renamed :
  ssl_fc_* = Front Connection (attributes of the connection itself)
  ssl_c_*  = Client side certificate
MINOR: ssl: add pattern and ACLs fetches 'ssl_fc_protocol', 'ssl_fc_cipher', 'ssl_fc_use_keysize' and 'ssl_fc_alg_keysize'

Some front connection fetches :
- ssl_fc_protocol = protocol name (string)
- ssl_fc_cipher = cipher name (string)
- ssl_fc_use_keysize = symmetric cipher key size used in bits (integer)
- ssl_fc_alg_keysize = symmetric cipher key size supported in bits (integer)
MINOR: ssl: add pattern fetch 'ssl_fc_session_id'

This fetch returns the SSL ID of the front connection. Useful to stick
on a given client.
MINOR: ssl: add pattern and ACLs fetches 'ssl_c_serial' and 'ssl_f_serial'

ssl_c_serial: serial of the certificate presented by the client.
ssl_f_serial: serial of the certificate presentend by the frontend.
MINOR: ssl: add pattern and ACLs fetches 'ssl_c_version' and 'ssl_f_version'

ssl_c_version : version of the cert presented by the client  (integer)
ssl_f_version : version of the cert presented by the frontend  (integer)
MINOR: ssl: add pattern and ACLs fetches 'ssl_c_s_dn', 'ssl_c_i_dn', 'ssl_f_s_dn' and 'ssl_c_i_dn'

ssl_c_s_dn : client cert subject DN (string)
ssl_c_i_dn : client cert issuer DN (string)
ssl_f_s_dn : frontend cert subject DN (string)
ssl_f_i_dn : frontend cert issuer DN (string)

Return either the full DN without params, or just the DN entry (first param) or
its specific occurrence (second param).
MINOR: ssl: add pattern and ACLs 'ssl_c_sig_alg' and 'ssl_f_sig_alg'

ssl_c_sig_alg: client cert signature algo (string). Ex: "RSA-SHA1"
ssl_f_sig_alg: frontend cert signature algo (string). Ex: "RSA-SHA1"
MINOR: ssl: add pattern and ACLs fetches 'ssl_c_key_alg' and 'ssl_f_key_alg'

ssl_c_key_alg: algo used to encrypt the client's cert key (ex: rsaEncryption)
ssl_f_key_alg: algo used to encrypt the frontend's cert key (ex: rsaEncryption)
MINOR: ssl: add pattern and ACLs fetches 'ssl_c_notbefore', 'ssl_c_notafter', 'ssl_f_notbefore' and 'ssl_f_notafter'

ssl_c_notbefore: start date of client cert (string, eg: "121022182230Z" for YYMMDDhhmmss[Z])
ssl_c_notafter: end date of client cert (string, eg: "121022182230Z" for YYMMDDhhmmss[Z])
ssl_f_notbefore: start date of frontend cert (string, eg: "121022182230Z" for YYMMDDhhmmss[Z])
ssl_f_notafter: end date of frontend cert (string, eg: "121022182230Z" for YYMMDDhhmmss[Z])
MINOR: ssl: add 'crt' statement on server.

crt: client certificate to send
MINOR: ssl: checks the consistency of a private key with the corresponding certificate
BUG/MEDIUM: command-line option -D must have precedence over "debug"

From the beginning it has been said that -D must always be used on the
command line from startup scripts so that haproxy does not accidentally
stay in foreground when loaded from init script... Except that this has
not been true for a long time now.

The fix is easy and must be backported to 1.4 too which is affected.
MINOR: tools: add a clear_addr() function to unset an address

This will be used to unset a from address.
BUG/MEDIUM: tcp: transparent bind to the source only when address is set

Thomas Heil reported that health checks did not work anymore when a backend
or server has "usesrc clientip". This is because the source address is not
set and tcp_bind_socket() tries to bind to that address anyway.

The solution consists in explicitly clearing the source address in the checks
and to make tcp_bind_socket() avoid binding when the address is not set. This
also has an indirect benefit that a useless bind() syscall will be avoided
when using "source 0.0.0.0 usesrc clientip" in health checks.
CLEANUP: remove trashlen

trashlen is a copy of global.tune.bufsize, so let's stop using it as
a duplicate, fall back to the original bufsize, it's less confusing
this way.
MAJOR: session: detach the connections from the stream interfaces

We will need to be able to switch server connections on a session and
to keep idle connections. In order to achieve this, the preliminary
requirement is that the connections can survive the session and be
detached from them.

Right now they're still allocated at exactly the same place, so when
there is a session, there are always 2 connections. We could soon
improve on this by allocating the outgoing connection only during a
connect().

This current patch touches a lot of code and intentionally does not
change any functionnality. Performance tests show no regression (even
a very minor improvement). The doc has not yet been updated.
DOC: update document describing relations between internal entities

Connections have left the stream interface. fdtab[] has been represented.