BUILD: http: rename error_message http_error_message to fix conflicts on RHEL

Duncan Hall reported a build issue on CentOS where error_message conflicts
with another system declaration when SSL is enabled. Rename the function.
BUILD: ssl: fix shctx build on RHEL with futex

On RHEL/CentOS, linux/futex.h uses an u32 type which is never declared
anywhere. Let's set it with a #define in order to fix the issue without
causing conflicts with possible typedefs on other platforms.
BUILD: include sys/socket.h to fix build failure on FreeBSD

Joris Dedieu reported that include/common/standard.h needs this.
BUILD: fix build error without SSL (ssl_cert)

One last-minute optimization broke the build without SSL support.
Move ssl_cert out of the #ifdef/#endif and it's OK.
MEDIUM: ssl: add support for prefer-server-ciphers option

I wrote a small path to add the SSL_OP_CIPHER_SERVER_PREFERENCE OpenSSL option
to frontend, if the 'prefer-server-ciphers' keyword is set.

Example :
	bind 10.11.12.13 ssl /etc/haproxy/ssl/cert.pem ciphers RC4:HIGH:!aNULL:!MD5 prefer-server-ciphers

This option mitigate the effect of the BEAST Attack (as I understand), and it
equivalent to :
	- Apache HTTPd SSLHonorCipherOrder option.
	- Nginx ssl_prefer_server_ciphers option.

[WT: added a test for the support of the option]
BUILD: ssl: use MAP_ANON instead of MAP_ANONYMOUS

FreeBSD uses the former, Linux uses the latter but generally also
defines the former as an alias of the latter. Just checked on other
OSes and AIX defines both. So better use MAP_ANON which seems to be
more commonly defined.
BUG/MEDIUM: workaround an eglibc bug which truncates the pidfiles when nbproc > 1

Thomas Heil reported that when using nbproc > 1, his pidfiles were
regularly truncated. The issue could be tracked down to the presence
of a call to lseek(pidfile, 0, SEEK_SET) just before the close() call
in the children, resulting in the file being truncated by the children
while the parent was feeding it. This unexpected lseek() is transparently
performed by fclose().

Since there is no way to have the file automatically closed during the
fork, the only solution is to bypass the libc and use open/write/close
instead of fprintf() and fclose().

The issue was observed on eglibc 2.15.
MEDIUM: config: support per-listener backlog and maxconn

With SSL, connections are much more expensive, so it is important to be
able to limit concurrent connections per listener in order to limit the
memory usage.
MINOR: session: do not send an HTTP/500 error on SSL sockets

If a session fails its initialization, we don't want to send HTTP/500
over the socket if it's not a raw data layer.
MEDIUM: config: implement maxsslconn in the global section

SSL connections take a huge amount of memory, and unfortunately openssl
does not check malloc() returns and easily segfaults when too many
connections are used.

The only solution against this is to provide a global maxsslconn setting
to reject SSL connections above the limit in order to avoid reaching
unsafe limits.
BUG: tcp: close socket fd upon connect error

When the data layer fails to initialize (eg: out of memory for SSL), we
must close the socket fd we just allocated.
MEDIUM: connection: improve error handling around the data layer

Better avoid calling the data functions upon error or handshake than
having to put conditions everywhere, which are too easy to forget (one
check for CO_FL_ERROR was missing, but this was harmless).
MINOR: config: make the tasks "nice" value configurable on "bind" lines.

This is very convenient to reduce SSL processing priority compared to
other traffic. This applies to CPU usage only, but has a direct impact
on latency under congestion.
LICENSE: add licence exception for OpenSSL

According to OpenSSL FAQ, GPL programs need an exception to use OpenSSL.

    http://openssl.org/support/faq.html#LEGAL2