http: protect against response splitting attacks

This patch is a back-port of 3c293ba.
Closes #4696
blog: v0.9.9
blog: v0.9.9 is unstable, not stable
test: disable simple/test-dgram-send-error

It's not a good citizen, it spams random IP addresses with UDP packets.

Fixes #4730.
blog: Peer Dependencies article

Thanks, @domenic
blog: Forgot slug on peer-dependencies article
udp_wrap: don't use namespace imports in header

It's not really harmful but it's inconsistent with the other header
files.
udp_wrap: use proper imports in source file
stream_wrap, udp_wrap: add read-only fd property

Expose the file descriptor as a read-only property on the internal
handle objects. Intended for debugging purposes, not part of the API
proper. The property is always null on Windows.

Fixes #4754.
doc: add prompt to fix repl_test.js example

Running repl.start without the prompt set produces this error:

repl.js:95
    throw new Error('An options Object, or a prompt String are required');
          ^
Error: An options Object, or a prompt String are required
    at new REPLServer (repl.js:95:11)
    at Object.exports.start (repl.js:321:14)
    at Object.<anonymous> (/Users/dan/Dropbox/Documents/dev/nextgen/repl_test.js:5:6)
    at Module._compile (module.js:449:26)
    at Object.Module._extensions..js (module.js:467:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.runMain (module.js:492:10)
    at process.startup.processNextTick.process._tickCallback (node.js:244:9)
doc: add tools/ dir to CONTRIBUTING.md verboten list
doc: clarify child_process.exec() stdio option

It only works for stdin, not stdout/stderr, for obvious reasons.
http: Raise hangup error on destroyed socket write

Prior to v0.10, Node ignored ECONNRESET errors in many situations.
There *are* valid cases in which ECONNRESET should be ignored as a
normal part of the TCP dance, but in many others, it's a very relevant
signal that must be heeded with care.

Exacerbating this problem, if the OutgoingMessage does not have a
req.connection._handle, it assumes that it is in the process of
connecting, and thus buffers writes up in an array.

The problem happens when you reuse a socket between two requests, and it
is destroyed abruptly in between them.  The writes will be buffered,
because the socket has no handle, but it's not ever going to GET a
handle, because it's not connecting, it's destroyed.

The proper fix is to treat ECONNRESET correctly.  However, this is a
behavior/semantics change, and cannot land in a stable branch.

Fix #4775
http: Do not let Agent hand out destroyed sockets

Fix #4373
npm: Upgrade to v1.2.11
2013.02.15, Version 0.8.20 (Stable)

* npm: Upgrade to v1.2.11

* http: Do not let Agent hand out destroyed sockets (isaacs)

* http: Raise hangup error on destroyed socket write (isaacs)

* http: protect against response splitting attacks (Bert Belder)
Merge branch 'v0.8.20-release' into v0.8
Now working on v0.8.21
blog: Release v0.8.20
timer: move setImmediate from timer to uv_check

uv_check is the robust place to invoke setImmediate callbacks after
process.nextTick and before timers(setTimeout/setInterval)