http: protect against response splitting attacks

This patch is a back-port of 3c293ba.
Closes #4696
Now working on v0.9.10
blog: v0.9.9
blog: v0.9.9 is unstable, not stable
windows/msi: add feature selection to installer
windows/msi: more installer enhancements

Noteworthy installer improvements provided here:
* Support in the Installer UI for not installing shortcuts.
* Support in the Installer UI for choosing a custom install directory.
* Command line support for not installing shortcuts (ADDDEFAULT=nodejs)
* Command line support for custom install directory (INSTALLDIR=c:\tools\node)
test: disable simple/test-dgram-send-error

It's not a good citizen, it spams random IP addresses with UDP packets.

Fixes #4730.
V8: Upgrade to 3.15.11.15
V8: Reapply floating patches
doc: document the writable.end() callback function

Support for it was added in a9c4a20331d123dc38dcc878af335d88e1933562.
Merge pull request #108 from koichik/japanese

v0.9.9 対応．
Revert "typed arrays: copy non-ArrayBuffer in DataView ctor"

We're going to follow browser behavior here.

This reverts commit 7b0770bff56122c245f83e8ee9608e1a0082c15e.
Revert "typed arrays: only share ArrayBuffer backing store"

We're going to fix this differently. The real bug is that
Buffer::HasInstance() returns true for typed arrays.

This reverts commit 01ee551e704776d8547250ac015a5463613afb45.
buffer: fix Buffer::HasInstance() check

It was returning true for typed arrays. Check that the object was
instantiated with the Buffer constructor.
typed arrays: make DataView throw on non-ArrayBuffer

Make the DataView constructor throw an exception when the first
argument is not an ArrayBuffer. Follows the spec and the browsers.
typed arrays: copy Buffer in typed array constructor

Convert the Buffer to an ArrayBuffer. The typed_array.buffer property
should be an ArrayBuffer to avoid confusion: a Buffer doesn't have a
byteLength property and more importantly, its slice() method works
subtly different.

That means that before this commit:

  var buf = new Buffer(1);
  var arr = new Int8Array(buf);
  assert.equal(arr.buffer, buf);
  assert(arr.buffer instanceof Buffer);

And now:

  var buf = new Buffer(1);
  var arr = new Int8Array(buf);
  assert.notEqual(arr.buffer, buf);
  assert(arr.buffer instanceof ArrayBuffer);
doc: update buffer/typed array documentation

Clarify that typed array constructors accept buffers as their first
argument but that the memory is not shared and why this was changed
in v0.9.
test: fix common.mustCall

Don't run the 'has function been called?' checks if the test is exiting
with an error because a failed check will mask the real exception.

v0.8 doesn't have the _fatalException machinery in src/node.js and
src/node.cc so it doesn't have this issue.
node: don't malloc in FromConstructorTemplate

* allocate space for argv on the stack
* move the declaration to node_internals.h
typed arrays: make call-as-function work for ctors

Turn call-as-function calls into constructor calls. Makes the following
snippet work:

  var buf = ArrayBuffer(32);  // no 'new' but does the right thing