Renumber clauses to reduce diffs to other versions

NetBSD, OpenBSD, and Android's Bionic number the clauses 1 through 3,
so follow suit to make comparison easier.
Remove the advertising clause from the Regents of the University of
California's license, per the letter dated July 22, 1999.
MFp4 @229085:

Rearrange the code so we don't call ioctl(TIOCGWINSZ) if the -s option is given,
as the result won't be used then.

Sponsored by:	The FreeBSD Foundation
MFp4 @229086:

Make use of Capsicum to protect kdump(1), as it might be used to parse data
from untrusted sources:

- Sandbox kdump(1) using capability mode.
- Limit stdin descriptor (where opened file is moved to) to only
  CAP_READ and CAP_FSTAT rights.
- Limit stdout descriptor to only CAP_WRITE, CAP_FSTAT and CAP_IOCTL.
  Plus limit allowed ioctls to TIOCGETA only, which is needed for
  isatty() to work.
- Limit stderr descriptor to only CAP_WRITE and CAP_FSTAT. In addition
  if the -s option is not given, grant CAP_IOCTL right, but allow for
  TIOCGWINSZ ioctl only, as we need screen width to dump the data.
- Before entering capability mode call catopen("libc", NL_CAT_LOCALE),
  which opens message catalogs and caches data, so that strerror(3)
  and strsignal(3) can work in a sandbox.

Sponsored by:	The FreeBSD Foundation
Discussed with:	rwatson
Temporarily revert r251058 - it breaks documented use of makeoptions
including the tinderbox.

 http://tinderbox.freebsd.org/tinderbox-head-build-HEAD-i386-i386.full
 make: don't know how to make modules-all. Stop
 make: stopped in /obj/i386.i386/src/sys/PAE
 *** Error code 2
Update comments to reflect use of svn/svnup to keep the src/ tree up
to date.

MFC after:	3 days
Avoid reading back certain registers following a write. This is an optimization.

Submitted by: David C Somayajulu
Approved by: George Neville Neil
o Change the locking scheme for swp_bcount.
  It can now be accessed with a write lock on the object containing it OR
  with a read lock on the object containing it along with the swhash_mtx.
o Remove some duplicate assertions for swap_pager_freespace() and
  swap_pager_unswapped() but keep the object locking references for
  documentation.

Sponsored by:	EMC / Isilon storage division
Reviewed by:	alc
sleep: Improve nanosleep() error handling:

 * Work around kernel bugs that cause a spurious [EINTR] return if a
   debugger (such as truss(1)) is attached.

 * Write an error message if an error other than [EINTR] occurs.

PR:		bin/178664
Post-r248567, there were times when the client would return a
truncated directory for some NFS servers. This turned out to
be because the size of a directory reported by an NFS server
can be smaller that the ufs-like directory created from the
RPC XDR in the client. This patch fixes the problem by changing
r248567 so that vnode_pager_setsize() is only done for regular files.

Reported and tested by:	hartmut.brandt@dlr.de
Reviewed by:	kib
MFC after:	1 week
r245757 introduced warning output if update method is set to CVS_UPDATE
or SUP_UPDATE.

CVS exporter for head/ is turned off for nearly one month now.

It is finally time to swing the ax at these update methods.

Reviewed by:	eadler
MFC after:	1 month
Fix typo introduced in r251084.

MFC after:	1 month
X-MFC-With:	r251084
Remove references to CVS_UPDATE and SUP_UPDATE to catch up with r251084.

MFC after:	1 month
X-MFC-With:	r251084, r251085
Revert a local change that sets the default for UsePrivilegeSeparation to
"sandbox" instead of "yes".  In sandbox mode, the privsep child is unable
to load additional libraries and will therefore crash when trying to take
advantage of crypto offloading on CPUs that support it.
Add a patch analygous to r248567, r248581, r251079 to the
old NFS client to avoid the panic reported in the PR by
doing the vnode_pager_setsize() call after unlocking the mutex.

PR:		177335
MFC after:	2 weeks
Shuffle around the cleanup unpause calls a bit.
Remove clause 3 and 4 from TNF licenses

Per the NetBSD Foundation statement
  Third parties are encouraged to change the license on any files which
  have a 4-clause license contributed to the NetBSD Foundation to a
  2-clause license.
Fix a false -> AH_FALSE.

Now, why this hasn't tripped _any_ tinderbox builds yet, I dunno.
It's been like this for a while.
Turn the reassociate debug print into a DPRINTF.
Forced commit to note that the sandbox issue was not about libraries, as
I erroneously stated in the commit log, but about a CRIOGET ioctl failing
due to a preceding setrlimit(RLIMIT_NOFILES, 0) call.