Get rid of write_safe

Current glibc implementation is safe. Kernel does this atomically,
and write is actually implemented through writev. So if write is
async-signal-safe, than writev pretty much must be too.
Base mkostemp_safe on mkostemp

It is nice to wrap umask handling and return convention,
but glibc's mkostemp is async-signal-safe already.
manager: print ephemeral information about running jobs' timeouts (v2)

This reverts commit 28c758de94bc8ba97b89d9dab3f517cf466978d0
but makes job_coldplug smarter.

In (v1) I changed the job start timestamp to be always set, so the
start time can be reported in the cylon eye message.  The bug was that
when deserializing jobs, they would be ignored if their start
timestamp was unset which was synonymous with no timeout. But after
the change, jobs would have a start timestamp set despite having no
timeout. After deserialization they would be considered immediately
expired. Fix this by checking if the timeout is not zero when
considering jobs for expiration.
manager: requeue the cylon eye for 5s later when a job finishes

We'd reqeue the next status update very soon after. Change it so that we wait
for full 5s without any job status changes until we print anything.
manager: remove "debugging" "feature"
man: remove erroneous history section
bus: fake security labels again

(The kernel module got fixed, so let's reenable this again)
core: introduce new KillMode=mixed which sends SIGTERM only to the main process, but SIGKILL to all daemon processes

This should fix some race with terminating systemd --user, where the
system systemd instance might race against the user systemd instance
when sending SIGTERM.
service: allow KillMode=mixed in conjunction with PAMName=
keymap: Add Toshiba EQUIUM

Thanks Aleksander Kowalski <aleksander.kowalski.1@gmail.com>!
core: make sure to always go through both SIGTERM and SIGKILL states of units

Given that we now have KillMode=mixed where SIGTERM might kill a smaller
set than SIGKILL we need to make sure to always go explicitly throught
the SIGKILL state to get the right end result.
core: use a bit more PID_FMT
core: in containers, don't wait for cgroup empty notifications which will never come
nspawn: fix reboot event fd reuse
bus: the owner of the bus driver name as reported by the driver's
GetNameOwner() bus call is the bus driver name itself, for compatibility
with dbus1
bus: when proxying messages from the bus driver patch the driver's well-known name into the sender
update TODO
update-utmp: code modernizations
utmp: make sure we don't write the utmp reboot record twice on each boot

(Also, only send the audit msg once, too)
networkd: dhcpv4 - add notion of 'CriticalConnection'

These connections are never torn down, even when the DHCP specifications say that
they should be. This is useful/necessary when the rootfs (or another critical fs)
is mounted over this network connection, and dataloss would result if the connection
is lost.

This option defaults to off, but our initrd generator (TBD) will enable it when
applicable.