http: protect against response splitting attacks

This patch is a back-port of 3c293ba.
Closes #4696
blog: v0.9.9
blog: v0.9.9 is unstable, not stable
test: disable simple/test-dgram-send-error

It's not a good citizen, it spams random IP addresses with UDP packets.

Fixes #4730.
stream: Empty strings/buffers do not signal EOF any longer
stream: read(0) should not always trigger _read(n,cb)

This is causing the CryptoStreams to get into an awful state when
there is a tight loop calling connection.write(chunk) waiting for
a false return.

Because CryptoStreams use read(0) to cycle data, this was causing
the encrypted side to pull way too much data in from the cleartext
side, since the read(0) would make it always call _read.

The unfortunate side effect, fixed in the next patch, is that
CryptoStreams don't automatically cycle when the Socket drains.
tls: Cycle data when underlying socket drains
Fix crypto.hmac behavior with empty keys.

node 0.9.6 introduced Buffer changes that cause the key argument of
Hmac::HmacInit (used in crypto.createHmac) to be NULL when the key is
empty. This argument is passed to OpenSSL's HMAC_Init, which does not
like NULL keys.

This change works around the issue by passing an empty string to
HMAC_Init when the key is empty, and adds crypto.createHmac tests for
the edge cases of empty keys and values.
test: fix tests after ECONNRESET patch
bench: make io.c file path configurable
blog: Peer Dependencies article

Thanks, @domenic
blog: Forgot slug on peer-dependencies article
net: Respect the 'readable' flag on sockets

Previously, we were only destroying sockets on end if their readable
side had already been ended.  This causes a problem for non-readable
streams, since we don't expect to ever see an 'end' event from those.

Treat the lack of a 'readable' flag the same as if it was an ended
readable stream.

Fix #4751
buffer: accept negative indices in Buffer#slice()

A negative start or end parameter now indexes from the end of the
buffer. More in line with String#slice() and ArrayBuffer#slice().
udp_wrap: don't use namespace imports in header

It's not really harmful but it's inconsistent with the other header
files.
udp_wrap: use proper imports in source file
stream_wrap, udp_wrap: add read-only fd property

Expose the file descriptor as a read-only property on the internal
handle objects. Intended for debugging purposes, not part of the API
proper. The property is always null on Windows.

Fixes #4754.
doc: add prompt to fix repl_test.js example

Running repl.start without the prompt set produces this error:

repl.js:95
    throw new Error('An options Object, or a prompt String are required');
          ^
Error: An options Object, or a prompt String are required
    at new REPLServer (repl.js:95:11)
    at Object.exports.start (repl.js:321:14)
    at Object.<anonymous> (/Users/dan/Dropbox/Documents/dev/nextgen/repl_test.js:5:6)
    at Module._compile (module.js:449:26)
    at Object.Module._extensions..js (module.js:467:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.runMain (module.js:492:10)
    at process.startup.processNextTick.process._tickCallback (node.js:244:9)
doc: add tools/ dir to CONTRIBUTING.md verboten list
doc: clarify child_process.exec() stdio option

It only works for stdin, not stdout/stderr, for obvious reasons.