http: protect against response splitting attacks

This patch is a back-port of 3c293ba.
Closes #4696
blog: v0.9.9
blog: v0.9.9 is unstable, not stable
test: disable simple/test-dgram-send-error

It's not a good citizen, it spams random IP addresses with UDP packets.

Fixes #4730.
blog: Peer Dependencies article

Thanks, @domenic
blog: Forgot slug on peer-dependencies article
doc: add prompt to fix repl_test.js example

Running repl.start without the prompt set produces this error:

repl.js:95
    throw new Error('An options Object, or a prompt String are required');
          ^
Error: An options Object, or a prompt String are required
    at new REPLServer (repl.js:95:11)
    at Object.exports.start (repl.js:321:14)
    at Object.<anonymous> (/Users/dan/Dropbox/Documents/dev/nextgen/repl_test.js:5:6)
    at Module._compile (module.js:449:26)
    at Object.Module._extensions..js (module.js:467:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.runMain (module.js:492:10)
    at process.startup.processNextTick.process._tickCallback (node.js:244:9)
doc: add tools/ dir to CONTRIBUTING.md verboten list
doc: clarify child_process.exec() stdio option

It only works for stdin, not stdout/stderr, for obvious reasons.
http: Raise hangup error on destroyed socket write

Prior to v0.10, Node ignored ECONNRESET errors in many situations.
There *are* valid cases in which ECONNRESET should be ignored as a
normal part of the TCP dance, but in many others, it's a very relevant
signal that must be heeded with care.

Exacerbating this problem, if the OutgoingMessage does not have a
req.connection._handle, it assumes that it is in the process of
connecting, and thus buffers writes up in an array.

The problem happens when you reuse a socket between two requests, and it
is destroyed abruptly in between them.  The writes will be buffered,
because the socket has no handle, but it's not ever going to GET a
handle, because it's not connecting, it's destroyed.

The proper fix is to treat ECONNRESET correctly.  However, this is a
behavior/semantics change, and cannot land in a stable branch.

Fix #4775
http: Do not let Agent hand out destroyed sockets

Fix #4373
npm: Upgrade to v1.2.11
2013.02.15, Version 0.8.20 (Stable)

* npm: Upgrade to v1.2.11

* http: Do not let Agent hand out destroyed sockets (isaacs)

* http: Raise hangup error on destroyed socket write (isaacs)

* http: protect against response splitting attacks (Bert Belder)
Merge branch 'v0.8.20-release' into v0.8
Now working on v0.8.21
blog: Release v0.8.20
Merge remote-tracking branch 'ry/v0.8' into master

Conflicts:
	AUTHORS
	ChangeLog
	lib/http.js
	src/node_version.h
	test/simple/test-http-header-response-splitting.js
http: Add fixme comment about ECONNRESET handling
doc: Use 'close' rather than 'exit' in spawn examples

Close #4515