Initial rework of packet filter framework.

- Large rework on packet filter framework to make many things easier.
   - Removed the PacketFilter::all_packets variable because it was confusing.
   - New variable (PacketFilter::enable_auto_protocol_capture_filters) to re-enable the old filtering model of only sniffing ports for analyzed protocols.
   - In progress plugin model for adding filtering mechanisms.
   - New default single item for capture_filters = { ["default"] = PacketFilter::default_capture_filter };
   - Mechanism and helper functions to "shunt" traffic with filters.

- Created the Protocols framework to assist with reworking how base protocol scripts are registered with DPD and other things.
   - Protocols framework creates BPF filters for registered analyzers. (if using PacketFilter framework in that mode).
Merge remote-tracking branch 'origin/master' into topic/seth/scripts-for-2.1

Conflicts:
	scripts/base/frameworks/packet-filter/main.bro
Checkpoint on the packet filter framework.

- Packet loss interval changed to 5 minutes by default.  Users
  were getting too many notices from this.

- BPF load balancing (ipv4 and ipv6).  This will tie in with
  upcoming BroControl support for configuring this.

- BPF based connection sampling.

- Small improvements to how and when filters are installed.
Packet filter framework checkpoint.
Several final fixes for PacketFilter framework.

- Fixed how the dpd_* variables are written.

- Fixed a bug with the shunting code.

- Updated a few tests.
Last test update for PacketFilter framework.
Merging master.
change raw reader to use basic c io instead of fdstream encapsulation class.

preparation for future changes.
replace popen with fork and exec.

Note for future: eof only gets sent when the parent closes its in-pipe
after forking.
Streaming reads from external commands work without blocking anything.
allow sending data to stdin of child process
make reading from stdout and stderr simultaneously work.

Needs a few test-cases - but seems ok...
Merge remote-tracking branch 'origin/master' into topic/bernhard/input-update
A bunch of more changes for the raw reader

* send end_of_data event for all kind of streams
* send process_finished event containing exit code of child process for executed programs
* move raw-tests to separate directory
* expose name of input stream to readers
* better handling of some error cases in raw reader
* new force_kill option for raw reader which SIGKILLs progesses on exit

The ordering of events how they arrive in the main loop is a bit peculiar at the moment.
The process_finished event arrives in scriptland before all of the other events, even though
it should be sent last. I have not yet fully figured that out.
and close only fds that are currently open (the logging framework really
did not like that :) )
File analysis framework interface simplifications.

- Remove script-layer data input interface (will be managed directly
  by input framework later).

- Only track files internally by file id hash.  Chance of collision
  too small to justify also tracking unique file string.
Add input interface to forward data for file analysis.

The new Input::add_analysis function is used to automatically forward
input data on to the file analysis framework.
Make default get_file_handle handlers &priority=5.

So they're easier to override (just provide a new handler without
specifying a priority).
Remove FileAnalysis::postpone_timeout.

FileAnalysis::set_timeout_interval can now perform same function.
Remove extraction counter in default file extraction scripts.