MsgBoard replies: Remove detour via C4Aul

Instead of having message board replies synced via script calls, send a
dedicated control packet.

Part of #936.
MsgBoard commands: Handle and assemble on clients

MsgBoard commands used to be evaluated on the issuing client. Malicious
clients would be able to insert arbitrary C4Script code to be executed
instead of the scenario-defined command; other clients would not be able
to tell the difference.

Instead, we now only send the command identifier, issuing player and
command parameter. This is still not perfect because clients can
insert any player they want, but it's better than before.

Part of #936.
Player self-management: Use dedicated control packets

Instead of sending pre-composed C4Script code across the network, make
player self-management (surrendering, team changes etc.) send a
dedicated control packet. This means less network traffic, and also a
smaller attack vector for malicions C4Script injection.

Part of #936.
Script executed on behalf of a script debugger is not engine-internal

While fInternal-flagged script controls may be useful for debuggers to
evaluate watch expressions because they don't get shown ingame, they
also bypass all checks the engine does and as such are a nightmare in
network play.

Part of #936.
Use control packet for player control initialization

This removes some more pre-assembled C4Script code going across the
network unchecked.

Part of #936.
Use control packet for more editor mode actions

Actions changed include dropping definitions, (de-)selecting objects,
player elimination. This removes some more pre-assembled C4Script code
going across the network unchecked.

Part of #936.
Fix GTK build
Use control packet for mouse drag/drop and hover

This removes some more pre-assembled C4Script code going across the
network unchecked.

Part of #936.
Remove C4ControlScript::fInternal

fInternal basically acted as a reverse "evil bit" as in RFC 3514: when
set, the engine would not do any checks on the script contained in the
control packet, nor log the script (visibly in game; the packet log
would of course contain the packet). A malicious game client thus would
be able to inject arbitrary script without people (immediately) noticing
anything was amiss.

As of this patch, only the host is able to execute arbitrary scripts,
and those will be shown in the message board for all players to see.
This privilege can be irrevocably disabled in network games by any
client by using the "/nodebug" message board command.

Closes #936.
Add C4ControlPlayerMouse to packet handler data, so unpacking it works
C4ControlEMMoveObject: Send dropped ID as name instead of handle

Sending handles might desync network games if one of the connected
engines had run a different scenario before the current one, since ID
handles aren't cleared between games.
Merge branch 'issue936'