Improve TCP FIN retransmission handling.

In the case multiple FIN packets are seen from a TCP endpoint (e.g.
when one is retransmitted), only the first counted towards a byte in the
sequence space.  This could cause a subsequent FIN packet to induce an
incorrect wrap around in the sequence numbers (e.g.  the retransmitted
FIN packet now is one sequence number behind the the first) and
misleadingly large connection sizes.  The change is to always treat a
FIN packet as counting one byte in to the sequence space.
Improve gap reporting in TCP connections that never see data.

The previous behavior was to accomodate SYN/FIN/RST-filtered traces by
not reporting missing data (via the content_gap event) for such
connections.  The new behavior always reports gaps for connections that
are established and terminate normally, but sequence numbers indicate
that all data packets of the connection were missed.  The behavior can
be reverted by redef'ing "detect_filtered_trace".
Improve TCP connection size reporting for half-open connections.

If TCP endpoint A and B are synchronized at some point, but A
closes/aborts/crashes and B goes on without knowledge of it and then A
tries to re-synchronize, Bro could end up seeing something like
(sequence numbers made up):

A: SYN 100
B: ACK 500
A: RST 500

The final sequence number of A, in this case, is not useful in the
context of determining the number of data bytes sent by A, so Bro now
reports that as 0 (where before it could often be misleadingly large).
Fix file_over_new_connection event to trigger when entire file is missed.

If a file is nothing but gaps (e.g. due to missing/dropped packets), Bro
can sometimes detect a file is supposed to have been present and never
saw any of its content, but failed to raise file_over_new_connection
events for it.  This was mostly apparent because the tx_hosts/rx_hosts
fields in files.log would not be populated in such cases (but are now
with this change).
Fix x509_extension event.

The event now really returns the extension. If openssl supports printing
it, it is converted into the openssl ascii output.

The output does not always look pretty because it can contain newlines.

New event syntax:
event x509_extension(c: connection, is_orig: bool, cert:X509, extension: X509_extension_info)

Example output for extension:
  [name=X509v3 Extended Key Usage,
    short_name=extendedKeyUsage,
    oid=2.5.29.37,
    critical=F,
    value=TLS Web Server Authentication, TLS Web Client Authentication]
  [name=X509v3 Certificate Policies,
   short_name=certificatePolicies,
   oid=2.5.29.32,
   critical=F,
   value=Policy: 1.3.6.1.4.1.6449.1.2.1.3.4^J  CPS: https://secure.comodo.com/CPS^J]
Minor grammar edits to Installation and Quick Start pages
Merge remote-tracking branch 'origin/topic/bernhard/fix-x509-extensions'

* origin/topic/bernhard/fix-x509-extensions:
  Fix x509_extension event.

BIT-1120 #merged
Merge remote-tracking branch 'origin/topic/jsiwek/tcp-improvements'

* origin/topic/jsiwek/tcp-improvements:
  Fix file_over_new_connection event to trigger when entire file is missed.
  Improve TCP connection size reporting for half-open connections.
  Improve gap reporting in TCP connections that never see data.
  Improve TCP FIN retransmission handling.

BIT-1119
Updating submodule(s).

 [nomail]
Added some grammar and spelling corrections to Installation and Quick Start Guide.
Extend file analysis API to allow file ID caching, adapt HTTP to use it.

This allows an analyzer to either provide file IDs associated with some
file content or to cache a file ID that was already determined by
script-layer logic so that subsequent calls to the file analysis
interface can bypass costly detours through script-layer.  This can
yield a decent performance improvement for analyzers that are able to
take advantage of it and deal with streaming content (like HTTP).
Revert use of HTTP file ID caching for gaps range request content.

Just an oversight on my part, this makes the use of file ID caching
consistent between the uses of the DataIn and Gap interfaces.
Merge remote-tracking branch 'origin/fastpath'

* origin/fastpath:
  Also use exec-module test to check for leaks.
Merge remote-tracking branch 'origin/topic/jsiwek/http-file-id-caching'

* origin/topic/jsiwek/http-file-id-caching:
  Revert use of HTTP file ID caching for gaps range request content.
  Extend file analysis API to allow file ID caching, adapt HTTP to use it.

BIT-1125 #merged
Updating submodule(s).

 [nomail]
Merge remote-tracking branch 'origin/topic/jdopheid/bro/edits_to_installation_and_getting_started'

* origin/topic/jdopheid/bro/edits_to_installation_and_getting_started:
  Added some grammar and spelling corrections to Installation and Quick Start Guide.
  Minor grammar edits to Installation and Quick Start pages

BIT-1123 #merged
Minor unified2 script documentation fix.