Don't leak temporary fds pointing to /dev/null

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=56927
[commit message added -smcv]
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
NEWS
CVE-2013-2168: _dbus_printf_string_upper_bound: copy the va_list for each use

Using a va_list more than once is non-portable: it happens to work
under the ABI of (for instance) x86 Linux, but not x86-64 Linux.

This led to _dbus_printf_string_upper_bound() crashing if it should
have returned exactly 1024 bytes. Many system services can be induced
to process a caller-controlled string in ways that
end up using _dbus_printf_string_upper_bound(), so this is a denial of
service.

Reviewed-by: Thiago Macieira <thiago@kde.org>
Add a test-case for CVE-2013-2168

Reviewed-by: Thiago Macieira <thiago@kde.org>
Fix distcheck: remove potentially-read-only files from builddir

During distcheck, the srcdir is read-only. During "make all", cp may
preserve the read-only status of the file copied from the srcdir,
resulting in failure to overwrite it with an identical file during
"make check" (which depends on all-local).

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Fix distcheck with newer Doxygen: remove *.js, too, during uninstall
Prepare embargoed release for tomorrow
Start 1.4.27