http: protect against response splitting attacks

This patch is a back-port of 3c293ba.
Closes #4696
blog: v0.9.9
blog: v0.9.9 is unstable, not stable
test: disable simple/test-dgram-send-error

It's not a good citizen, it spams random IP addresses with UDP packets.

Fixes #4730.
blog: Peer Dependencies article

Thanks, @domenic
blog: Forgot slug on peer-dependencies article
doc: add prompt to fix repl_test.js example

Running repl.start without the prompt set produces this error:

repl.js:95
    throw new Error('An options Object, or a prompt String are required');
          ^
Error: An options Object, or a prompt String are required
    at new REPLServer (repl.js:95:11)
    at Object.exports.start (repl.js:321:14)
    at Object.<anonymous> (/Users/dan/Dropbox/Documents/dev/nextgen/repl_test.js:5:6)
    at Module._compile (module.js:449:26)
    at Object.Module._extensions..js (module.js:467:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.runMain (module.js:492:10)
    at process.startup.processNextTick.process._tickCallback (node.js:244:9)
doc: add tools/ dir to CONTRIBUTING.md verboten list
doc: clarify child_process.exec() stdio option

It only works for stdin, not stdout/stderr, for obvious reasons.
http: Raise hangup error on destroyed socket write

Prior to v0.10, Node ignored ECONNRESET errors in many situations.
There *are* valid cases in which ECONNRESET should be ignored as a
normal part of the TCP dance, but in many others, it's a very relevant
signal that must be heeded with care.

Exacerbating this problem, if the OutgoingMessage does not have a
req.connection._handle, it assumes that it is in the process of
connecting, and thus buffers writes up in an array.

The problem happens when you reuse a socket between two requests, and it
is destroyed abruptly in between them.  The writes will be buffered,
because the socket has no handle, but it's not ever going to GET a
handle, because it's not connecting, it's destroyed.

The proper fix is to treat ECONNRESET correctly.  However, this is a
behavior/semantics change, and cannot land in a stable branch.

Fix #4775
http: Do not let Agent hand out destroyed sockets

Fix #4373
npm: Upgrade to v1.2.11
2013.02.15, Version 0.8.20 (Stable)

* npm: Upgrade to v1.2.11

* http: Do not let Agent hand out destroyed sockets (isaacs)

* http: Raise hangup error on destroyed socket write (isaacs)

* http: protect against response splitting attacks (Bert Belder)
Merge branch 'v0.8.20-release' into v0.8
Now working on v0.8.21
blog: Release v0.8.20
blog: v0.9.10
test: add TAP output to the test runner

This is a back-port of commit 14ed173 from the master branch.
zlib: fix assert on bad input

The following test case occasionally triggered an assert because
write_in_progress_ didn't get cleared on error:

  $ cat test.js
  require('zlib').gunzip('BAM', console.log);
  setTimeout(gc, 10);

  $ while true; do node --expose-gc test.js || break; done
  { [Error: incorrect header check] errno: -3, code: 'Z_DATA_ERROR' }
  Assertion failed: (!write_in_progress_ && "write in progress"),
  function Clear, file ../src/node_zlib.cc, line 71.
  Abort trap: 6

Steps to avoid that:

* Initialize all primitive member fields in the constructor.
* Clear the write_in_progress_ member field in ZCtx::Error().
* Ref the ZCtx object as soon as write_in_progress_ is set to true.
  Before this commit, it could get GC'ed in the time between setting
  the field and the call to ctx->Ref().

Fixes #4783.
doc: add note about child process line buffering

Fixes #4808.