stream: Make sure no watcher callback is active while changing stream callbacks

When changing async callbacks on streams, we have to make sure the watcher
callback is not currently active and has temporarily disabled callbacks. This
could have been the case, as we didn't explicitly removed any pending
watcher registration if both callbacks are NULL.

By enforcing the watcher unregistration, we are sure the watcher callback is
not active and currently is not mangling the callback hooks. This should make
sure we avoid any races for the callback variables.
watcher: Don't complain if select() syscall got interrupted
array: Add an array_get() function
unit-tests: Pass a test suite collection name to print during test execution

As we except to get more and more test runners for the different components,
we add a name to easily identify them on the test output.
checksum must be the last subdir included

Otherwise charon-cmd will not yet be installed when the checksums are
calculated (now from the install dir, not the build dir).

Fixes #496.
ikev2: Wipe (optional) shared secret during CHILD_SA key derivation
ike: Use proper hostname(s) when name resolution failed

Was wrong since 0edce687675df8f10f4026fa12a8fc3b3dd003f5.

Fixes #440.
ike: Simplify error handling if name resolution failed

This avoids a second name resolution attempt just to determine if %any
etc. was configured.

Fixes #440.
agent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket

This is also required if charon-cmd is used with capability dropping.
configure: Add -Wno-format-security to default CFLAGS

Either due to a change in Ubuntu 13.10 or GCC 4.8 -Wno-format has no
effect if -Wformat-security is enabled (which it is on Ubuntu) so we
also disable the latter by default.
pki: Properly use ?: when defining option arrays
pki: Print a warning if MAX_COMMANDS is too low
pki: Increase MAX_COMMANDS to cover all currently available commands

Fixes #452.
pki: Make sure no command registers too many options
stroke: Add an option to prevent log level changes via stroke socket
stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated

Otherwise a malicious user could send an unterminated string to cause
unterminated reads.
utils: Add strreplace function
curl: Replace spaces in URIs with %20

cURL requires the URIs to be URL-encoded. Apparently, some CAs encode CRL
URIs with spaces in them.

Fixes #454.
updown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated
updown: Allow IPIP traffic if IPComp was negotiated

The kernel implicitly creates an IPIP SA if an IPComp SA is installed.
This SA is used inbound for small packets that are not compressed.

Since the addresses are different (they are the tunnel addresses not
those of the tunneled traffic) additional rules are required if the
traffic selector does not cover the tunnel addresses (e.g. due to a NAT).

For SAs with multiple traffic selectors duplicate rules will get installed.