Add importNative primop

This can be used to import a dynamic shared object and return an
arbitrary value, including new primops. This can be used both to test
new primops without having to recompile nix every time, and to build
specialized primops that probably don't belong upstream (e.g. a function
that calls out to gpg to decrypt a nixops secret as-needed).

The imported function should initialize the Value & as needed. A single
import can define multiple values by creating an attrset or list, of
course.

An example initialization function might look like:

extern "C" void initialize(nix::EvalState & state, nix::Value & v)
{
    v.type = nix::tPrimOp;
    v.primOp = NEW nix::PrimOp(myFun, 1, state.symbols.create("myFun"));
}

Then `builtins.importNative ./example.so "initialize"` will evaluate to
the primop defined in the myFun function.
Only add the importNative primop if the allow-arbitrary-code-during-evaluation option is true (default false)
Merge branch 'shlevy-import-native'
allow-arbitrary-code-during-evaluation -> allow-unsafe-native-code-during-evaluation
Add `--json` argument to `nix-instantiate`
Style fix
Manual: html -> xhtml
Add builtin function ‘fromJSON’

Fixes #294.
Don't build on Ubuntu 10.10

Its C++ compiler is too old.

http://hydra.nixos.org/build/12385722
Fix compilation error on some versions of GCC

src/libexpr/primops.cc:42:8: error: looser throw specifier for 'virtual nix::InvalidPathError::~InvalidPathError()'
src/libexpr/nixexpr.hh:12:1: error:   overriding 'virtual nix::EvalError::~EvalError() noexcept (true)'

http://hydra.nixos.org/build/12385750
Add a test for the SSH substituter
Fix security hole in ‘nix-store --serve’

Since it didn't check that the path received from the client is a
store path, the client could dump any path in the file system.
nix-copy-closure: Fix race condition

There is a long-standing race condition when copying a closure to a
remote machine, particularly affecting build-remote.pl: the client
first asks the remote machine which paths it already has, then copies
over the missing paths. If the garbage collector kicks in on the
remote machine between the first and second step, the already-present
paths may be deleted. The missing paths may then refer to deleted
paths, causing nix-copy-closure to fail. The client now performs both
steps using a single remote Nix call (using ‘nix-store --serve’),
locking all paths in the closure while querying.

I changed the --serve protocol a bit (getting rid of QueryCommand), so
this breaks the SSH substituter from older versions. But it was marked
experimental anyway.

Fixes #141.
Remove maybeVfork
nix-copy-closure: Restore compression and the progress viewer
Refactoring: Move all fork handling into a higher-order function

C++11 lambdas ftw.
Remove tabs
nix-copy-closure: Fix --dry-run
nix-copy-closure -s: Do substitutions via ‘nix-store --serve’

This means we no longer need an SSH master connection, since we only
execute a single command on the remote host.
Fix use of sysread