Implement master-side pillar, ipcidr, and compound matching

@thatch45 should probably be the one to merge this.

Fixes #4831
Fixes #4957
Paves the way for #5505

Probably some other issue resolved or ready to be addressed now as well.

I have not tested this with extremely complex compound matches, as I my minions are not very varied.  I did test some basic compound matches, including parenthesis, `not`, and as many edge cases as I could think of.  Pillar matching is working.

The compound matcher on the master takes advantage of set theory and the set shortcuts (`&`, `|`, `-`).  I *think* the `eval()` is still safe, because we carefully evaluate everything in the original expression and only add things to `results` that we have generated.  No way an attacker could inject code there.

The compound matcher was a beast to write and reason about, so I would love any input anyone can give.  I'd also be happy to walk anyone through the logic -- I couldn't find a good way to document inline without writing a novel.

Anyone who can help test the compound matcher more thoroughly before 0.17 would be a great help.