Misc. documentation fixes.

Silences some warnings from Sphinx.
At the moment, SSL connections where the ssl_established event does not fire are not logged.

That means that, for example, connections that are terminated with an alert during the
handshake never appear in the ssl.log.

This patch changes this behavior - now all ssl connections that fire any event are logged.

The protocol confirmation of the ssl analyzer is moved to the client_hello instead to
the server hello. Furthermore, an additional field is added to ssl.log, which indicates
if a connection has been established or not (which probably indicates a handshake problem).
update test baselines
only call disable_analyzer if the connection is still open.
Fix DNS SRV responses and a small issue with NBNS queries and label length.

 - DNS SRV responses never had the code written to actually
   generate the dns_SRV_reply event.  Adding this required
   extending the event a bit to add extra information.  SRV responses
   now appear in the dns.log file correctly.

 - Fixed an issue where some Microsoft NetBIOS Name Service lookups
   would exceed the max label length for DNS and cause an incorrect
   "DNS_label_too_long" weird.
No longer accidentally attempting to parse NBSTAT RRs as SRV RRs.

The NetBios name service RFC (1002) specified NBSTAT (NetBios Status)
resource records to have identifier 0x0021.  The DNS SRV RFC specified
SRV records to have identifier 33.  Unfortunately those are the
same number. :)

We now check the resp port to handle this situation better so that
we won't be attempting to parse NBSTAT records as SRV (which
causes several weird messages).
Fix bug in Connection::FlipRoles, addresses BIT-1148.

It didn't swap address values right and also didn't consider that
analyzers might be scheduled for the new connection tuple.

Issues were reported by Kevin McMahon, thanks.
Merge remote-tracking branch 'origin/topic/bernhard/ssl-failure'

* origin/topic/bernhard/ssl-failure:
  only call disable_analyzer if the connection is still open.
  update test baselines
  At the moment, SSL connections where the ssl_established event does not fire are not logged.
Merge remote-tracking branch 'origin/topic/seth/dns-srv-fix'

* origin/topic/seth/dns-srv-fix:
  No longer accidentally attempting to parse NBSTAT RRs as SRV RRs.
  Fix DNS SRV responses and a small issue with NBNS queries and label length.

BIT-1147 #merged
Refactored formatters and updated the the writers a bit.

 - Formatters have been abstracted similarly to readers and writers now.
 - The Ascii writer has a new option for writing out logs as JSON.
 - The Ascii writer now has all options availble as per-filter
   options as well as global.
Fix non-deterministic logging of unmatched DNS msgs, addresses BIT-1153

Unmatched DNS messages may fail to be logged sometimes due to a type of
iterator invalidation.
Merge remote-tracking branch 'origin/topic/jsiwek/bit-1153'

* origin/topic/jsiwek/bit-1153:
  Fix non-deterministic logging of unmatched DNS msgs, addresses BIT-1153

BIT-1153 #merged
Added an option to the JSON formatter to use ISO 8601 for timestamps.

 - It's not *exactly* ISO 8601 which doesn't seem to support
   subseconds, but subseconds are very important to us and
   most things that support ISO8601 seem to also support subseconds
   in the way I'm implemented it.
Teach configure script --enable-jemalloc, --with-jemalloc.

Addresses BIT-1128.
Fix --with-jemalloc and make it imply --enable-jemalloc.
Teach async DNS lookup builtin-functions about BRO_DNS_FAKE.

And enable fake DNS mode for test suites.

Addresses BIT-1134.
Improve performance of MHR script, addresses BIT-1139.

The MHR script involves a "when" statement which can be expensive due to
the way it clones frames/vals.  In this case, the fa_file record is
expensive to clone, but this change works around that by unrolling only
the necessary fields from it that are needed to populate a Notice::Info
record.  A drawback to this is that the full fa_file or connection
records aren't available in the Notice::Info record when evaluating
Notice::policy hooks for MHR hit notices (though they can possibly be
recovered by using e.g. the lookup_connection() builtin_function).
Merge branch 'master' into topic/jsiwek/flip-roles
Improve analysis of TCP SYN/SYN-ACK reversal situations.

- Since it's just the handshake packets out of order, they're no
  longer treated as partial connections, which some protocol analyzers
  immediately refuse to look at.

- The TCP_Reassembler "is_orig" state failed to change, which led to
  protocol analyzers sometimes using the wrong value for that.

- Add a unit test which exercises the Connection::FlipRoles() code
  path (i.e. the SYN/SYN-ACK reversal situation).

Addresses BIT-1148.
Ascii input reader now supports all config options per-input stream.