change raw reader to use basic c io instead of fdstream encapsulation class.

preparation for future changes.
replace popen with fork and exec.

Note for future: eof only gets sent when the parent closes its in-pipe
after forking.
Streaming reads from external commands work without blocking anything.
allow sending data to stdin of child process
make reading from stdout and stderr simultaneously work.

Needs a few test-cases - but seems ok...
Merge remote-tracking branch 'origin/master' into topic/bernhard/input-update
A bunch of more changes for the raw reader

* send end_of_data event for all kind of streams
* send process_finished event containing exit code of child process for executed programs
* move raw-tests to separate directory
* expose name of input stream to readers
* better handling of some error cases in raw reader
* new force_kill option for raw reader which SIGKILLs progesses on exit

The ordering of events how they arrive in the main loop is a bit peculiar at the moment.
The process_finished event arrives in scriptland before all of the other events, even though
it should be sent last. I have not yet fully figured that out.
and close only fds that are currently open (the logging framework really
did not like that :) )
File analysis framework interface simplifications.

- Remove script-layer data input interface (will be managed directly
  by input framework later).

- Only track files internally by file id hash.  Chance of collision
  too small to justify also tracking unique file string.
Add input interface to forward data for file analysis.

The new Input::add_analysis function is used to automatically forward
input data on to the file analysis framework.
Make default get_file_handle handlers &priority=5.

So they're easier to override (just provide a new handler without
specifying a priority).
Remove FileAnalysis::postpone_timeout.

FileAnalysis::set_timeout_interval can now perform same function.
Remove extraction counter in default file extraction scripts.
Remove logging of analyzers field of FileAnalysis::Info.

It was mostly redundant when logged, but still can be useful to
inspect at runtime.  In the future, a better field for logging
will be available which will be similar to the "service" field
for connection records (there's not any file-format-specific
analyzers that would currently make use of such a thing).
Fix HTTP multipart body file analysis.

Each part now gets assigned a different file handle/id.
Improve tracking of HTTP file extraction (addresses #988).

http.log now has files taken from request and response bodies in
different fields for each, and can now track multiple files per body.
That is, the "extraction_file" field is now "extracted_request_files"
and "extracted_response_files".
Improve file analysis doxygen comments.
Add a general file analysis overview/how-to document.
Merge remote branch 'origin/master' into topic/bernhard/input-update
linux does not have strnstr