jv_invalid() shouldn't allocate

jv_invalid() should behave like jv_invalid_with_msg(jv_null()), and
neither should allocate memory, because neither ought to need to.
exec_stack.h was not using jv_mem_realloc()
Add jq_handle concept
Add --args option
Add jq_runtime_flags enum type
Add fopen and popen builtins
Better handling of popen in f_read
Document --args option
Document --allow-* options
Add `write`
Document `read`, `write`, `fopen`, and `popen`
Better handling of popen exit status
Add `buffer` builtin for keeping state

The `buffer` builtin is like `fopen` of a temporary file in that it
returns a handle that can be written to and read from.  The last value
written is always the value returned by read, and buffers always start
out with a null value.
Document the `buffer` builtin
Change `buffer` to be a one-shot

For efficiency, it helps if reading a buffer empties it.  That way
the jv returned by `read` will have one fewer references, easily just
one, which then avoids the whole COW thing.
Document change to make `buffer` a one-shot
Make `fopen` and `popen` take fewer args

Move their three argumetns to a single object argument.
Docs change for fopen/popen simplification
Fix handle memleak