Avoid busy-looping on WANTREAD within connection_handle_write

Fix for bug 5650.  Also, if we get a WANTREAD while reading while
writing, make sure we're reading.
Don't run off the end of the array-of-freelists

This is a fix for bug 8844, where eugenis correctly notes that there's
a sentinel value at the end of the list-of-freelists that's never
actually checked.  It's a bug since the first version of the chunked
buffer code back in 0.2.0.16-alpha.

This would probably be a crash bug if it ever happens, but nobody's
ever reported something like this, so I'm unsure whether it can occur.
It would require write_to_buf, write_to_buf_zlib, read_to_buf, or
read_to_buf_tls to get an input size of more than 32K.  Still, it's a
good idea to fix this kind of thing!
Merge branch 'bug8844_v2' into maint-0.2.3
Update to the May 2013 GeoIP database.
Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
Update to the June 2013 GeoIP database.
Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
Fix (Open?)BSD fast-connect bug with optimistic data.

There's an assertion failure that can occur if a connection has
optimistic data waiting, and then the connect() call returns 0 on the
first attempt (rather than -1 and EINPROGRESS).  That latter behavior
from connect() appears to be an (Open?)BSDism when dealing with remote
addresses in some cases. (At least, I've only seen it reported with
the BSDs under libevent, even when the address was 127.0.0.1.  And
we've only seen this problem in Tor with OpenBSD.)

Fixes bug 9017; bugfix on 0.2.3.1-alpha, which first introduced
optimistic data. (Although you could also argue that the commented-out
connection_start_writing in 155c9b80 back in 2002 is the real source
of the issue.)
Merge branch 'bug9017' into maint-0.2.3
Don't queue more cells as a middle relay than the spec allows to be in flight
Increase the limit so leaky pipe might work
Merge branch 'circuit_queue_cap-0.2.3-squashed' into maint-0.2.3
Disable middle relay queue overfill detection code due to possible guard discovery attack
Limit hidden service descriptors to at most 10 guard nodes.

Fixes bug 9002; bugfix on 0.1.1.11-alpha (which introduced guard
nodes), or on 0.0.6pre1 (which introduced hidden services).
Implement a real OOM-killer for too-long circuit queues.

This implements "algorithm 1" from my discussion of bug #9072: on OOM,
find the circuits with the longest queues, and kill them.  It's also a
fix for #9063 -- without the side-effects of bug #9072.

The memory bounds aren't perfect here, and you need to be sure to
allow some slack for the rest of Tor's usage.

This isn't a perfect fix; the rest of the solutions I describe on
codeable.
Merge branch 'bug9063_redux_023_squashed' into maint-0.2.3
Fix some problems with the bug9002 fix.

Fixes bug 9090; bug not in any released Tor.
Update to the July 2013 GeoIP database.
Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
Update to the August 2013 GeoIP database.