systemd unit file: only allow tor to write to /var/lib/tor and /var/log/tor (#12751).

The rest of the filesystem is accessible for reading only. Still, quoting
systemd.exec(5):

  Note that restricting access with these options does not extend to submounts
  of a directory that are created later on.
systemd unit file: ensures that the process and all its children can never gain
new privileges (#12939).
Add changes file for #12939.
Add changes file for #12751.
Bounds check while looping over a fixed size table or array

(Edited to use existing ARRAY_LENGTH macro --nickm)
Avoid unsigned/sign compare warning from last patch.
Adding changes file.
Merge remote-tracking branch 'origin/maint-0.2.5'
Fix a number of clang analyzer false-positives

Most of these are in somewhat non-obvious code where it is probably
a good idea to initialize variables and add extra assertions anyway.

Closes 13036.  Patches from "teor".
Merge remote-tracking branch 'origin/maint-0.2.5'
Another clang analyzer complaint wrt HT_GENERATE

We're calling mallocfn() and reallocfn() in the HT_GENERATE macro
with the result of a product.  But that makes any sane analyzer
worry about overflow.

This patch keeps HT_GENERATE having its old semantics, since we
aren't the only project using ht.h.  Instead, define a HT_GENERATE2
that takes a reallocarrayfn.
Apply the MALLOC_ZERO_WORKS fixup to tor_realloc as well.

Also, make MALLOC_ZERO_WORKS never get applied when clang analyzer is
running.  This should make the clangalyzer a little happier.
Explicitly initialize addresses in tor_ersatz_socketpair

This should stop a false positive from the clangalyzer.
Add an assertion to read_file_to_str_until_eof

The clangalyzer doesn't believe our math here.  I'm pretty sure our
math is right.  Also, add some unit tests.
Add more assertions to esc_for_log to please the clangalyzer.
Don't include a backtrace test for dereferencing 0 under analyzers

They hate this.
Use real pointers in unit tests, not (void*)101 etc

The clangalyzer hates (void*)101 etc
Make iter for DECLARE_TYPED_DIGESTMAP_FNS be a pointer.

This fixes a clangalyzer warning, and makes our C slightly better C.
Fix more (void*)11 warnings in the tests
Don't delay uploading a new desc if bw estimate was 0

When a tor relay starts up and has no historical information about its
bandwidth capability, it uploads a descriptor with a bw estimate of 0.
It then starts its bw selftest, but has to wait 20 minutes to upload the
next descriptor due to the MAX_BANDWIDTH_CHANGE_FREQ delay. This change
should mean that on average, relays start seeing meaningful traffic a
little quicker, since they will have a higher chance to appear in the
consensus with a nonzero bw.

Patch by Roger, changes file and comment by Sebastian.