curl_easy_perform: avoid busy-looping

When curl_multi_wait() finds no file descriptor to wait for, it returns
instantly and this must be handled gracefully within curl_easy_perform()
or cause a busy-loop. Starting now, repeated fast returns without any
file descriptors is detected and a gradually increasing sleep will be
used (up to a max of 1000 milliseconds) before continuing the loop.

Bug: http://curl.haxx.se/bug/view.cgi?id=1238
Reported-by: Miguel Angel
curl_multi_wait.3: clarify the numfds counter
RELEASE-NOTES: synced with 9c3e098259b82

Mention 7 recent bug fixes and their associated contributors
curl_easy_setopt.3: clarify CURLOPT_PROGRESSFUNCTION frequency

Make it clearer that the CURLOPT_PROGRESSFUNCTION callback will be
called more frequently than once per second when things are happening.
TODO: HTTP2/SPDY support
test506: verify that CURLOPT_COOKIELIST takes share lock

It doesn't right now: http://curl.haxx.se/bug/view.cgi?id=1215
CURLOPT_COOKIELIST: take cookie share lock

When performing COOKIELIST operations the cookie lock needs to be taken
for the cases where the cookies are shared among multiple handles!

Verified by Benjamin Gilbert's updated test 506

Bug: http://curl.haxx.se/bug/view.cgi?id=1215
Reported-by: Benjamin Gilbert
TODO: mention the DANE patch from March
RELEASE-NOTES: synced with e305f5ec715f
multi_socket: react on socket close immediately

As a remedy to the problem when a socket gets closed and a new one is
opened with the same file descriptor number and as a result
multi.c:singlesocket() doesn't detect the difference, the new function
Curl_multi_closed() gets told when a socket is closed so that it can be
removed from the socket hash. When the old one has been removed, a new
socket should be detected fine by the singlesocket() on next invoke.

Bug: http://curl.haxx.se/bug/view.cgi?id=1248
Reported-by: Erik Johansson
Use opened body.out file and write content to it.
Curl_urldecode: no peeking beyond end of input buffer

Security problem: CVE-2013-2174

If a program would give a string like "%FF" to curl_easy_unescape() but
ask for it to decode only the first byte, it would still parse and
decode the full hex sequence. The function then not only read beyond the
allowed buffer but it would also deduct the *unsigned* counter variable
for how many more bytes there's left to read in the buffer by two,
making the counter wrap. Continuing this, the function would go on
reading beyond the buffer and soon writing beyond the allocated target
buffer...

Bug: http://curl.haxx.se/docs/adv_20130622.html
Reported-by: Timo Sirainen
unit1396: unit tests to verify curl_easy_(un)escape
RELEASE-NOTES: synced with 0de7249bb39a2 - 7.31.0
THANKS: added 24 new contributors from the 7.31.0 release
bump: start working towards what most likely will become 7.32.0
dotdot: introducing dot file path cleanup

RFC3986 details how a path part passed in as part of a URI should be
"cleaned" from dot sequences before getting used. The described
algorithm is now implemented in lib/dotdot.c with the accompanied test
case in test 1395.

Bug: http://curl.haxx.se/bug/view.cgi?id=1200
Reported-by: Alex Vinnik
docs: fix typo in curl_easy_getinfo manpage
darwinssl: reform OS-specific #defines

This doesn't need to be in the release notes. I cleaned up a lot of the #if
lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and
MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like
__MAC_10_6 or whatever were defined, because for some SDKs Apple has released
they were defined out of place.
curl-config.in: replace tabs by spaces