Allow RT::Users->WhoBelongToGroups to optionally return unprivileged users

The WhoBelongToGroups filter should really not apply LimitToPrivileged at
all, but we can't remove it without breaking security assumptions elsewhere
in RT or in 3rd party code. So a new option IncludeUnprivileged is added, a
boolean that defaults to false. It can be set to true to disable the
LimitToPrivileged filter.

The documentation of the method is amended to explain that it filters out
unprivileged members by default.
Work around bugs in name resolution in SphinxSE on MySQL 5.5

No existant version of SphinxSE is currently capable of resolving
hostnames in CONNECTION= strings on MySQL 5.5.  As such, default to
127.0.0.1 when configuring the SphinxSE table on MySQL 5.5 or above.
See http://sphinxsearch.com/bugs/view.php?id=1815
Default to 127.0.0.1 in tests to work on MySQL 5.5
new callback AfterAttachments
Stop leaking an extra dbh during server startup

RT::Handle->CheckIntegrity is called during rt-server startup, and its
return value is is stored in $integrity.  Additionally, $RT::Handle is
explicitly destroyed, to ensure that the database is disconnected before
forking.

Unfortunately, this replies on the dbh going out of scope, and
disconnecting during its DESTROY.  As the dbh is stored in the
$integrity variable in addition to $RT::Handle->dbh, it never goes out
of scope, and is thus never disconnected.  For fastcgi deployments, this
causes every fastcgi process to hold open an extra database handle;
standalone servers only ever gain one extra handle.

As no callsite of CheckIntegrity relies on the $dbh return value, simply
return true.  This allows the database handle to be disconnected using
$RT::Handle->dbh(undef).
Explicitly disconnect the dbh before forking, if it exists

This remoes the reliance on disconnect-on-DESTROY, and ensures that the
database handle is disconnected even if outstanding references to
$RT::Handle->dbh still exist.
Very rough pass to bring RT::StyleGuide up to date

RT::StyleGuide has become very much dated with respect to RT's current
development practices.  Prune the worst of the conflicting advice from
it, and point to hacking.pod for a more recent take.
I#28784: Tests for non-ASCII character in password

Reproduce the following error:

  Wide character in subroutine entry at lib/RT/User.pm line 1002.
I#28784: Handle non-ASCII character in passwod

The md5 method expects a sequence of bytes.
Merge branch '4.0/non-ascii-password' into 4.0-trunk
Correct POD for Lifecycle methods
Failing test when passing 0 to AddDays
Properly add zero days when zero is passed

AddDays is documented to add one day if you pass no value, but
the previous default handling also added a day if you passed 0.
While uncommon, you may pass 0 in the context of date calculations
where zero is a possible value. Correcly handle 0 while
preserving the no argument default.
all_pod_files_ok only checked lib/

We have pod in lots of places.  Rather than catching our mistakes after
we podify things for docs.bestpractical.com, yell loudly when we screw
up RT_Config.pm or bin/rt-mailgate's pod too.
Warn about SetFieldsOnce

This callback was added in d77874ed to allow you to munge the %once
declared @fields variable.  If you used Default, you would keep
appending to the global shared variable.  When c07d62ad fixed the bug
that we were pushing Custom Fields onto the global shared variable by
switching from a %once to an %init, this callback became useless because
@fields was redeclared on every request.

The first commit was in 3.7.15, the second was in 3.7.86.  This means no
released version of RT has had a version of this callback which worked
properly.  We will remove it in 4.4 and add some dev notes here.

The correct solution is to use the Default callback.

CallbackOnce is still used properly with %once blocks in ColumnMap.
Merge branch '4.0/warn-about-SetFieldsOnce' into 4.0-trunk
Merge branch '4.0/test-non-lib-pod' into 4.0-trunk
Merge branch '4.0/prune-styleguide' into 4.0-trunk
Merge branch '4.0/fewer-active-handles' into 4.0-trunk
Merge branch '4.0/sphinx-on-mysql-5.5' into 4.0-trunk