Put rel="noreferrer" on all nonlocal links

Summary:
Ref T4342. By default, insert `rel="noreferrer"` for links. We do not insert this if:

  - The caller provided an explicit "rel" attribute.
  - We recognize the link as an anchor ("#comment-2"), or as local to the current domain ("/path/to/resource").

Otherwise, add it in all cases.

Test Plan: Added and executed unit tests. (The javascript stuff which was touched a little bit has a pile of tests already, too.)

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4342

Differential Revision: https://secure.phabricator.com/D8711
Add an "Always Search" flag to the libphutil LDAP adapter

Summary:
Ref T3208. This adds a flag which acts like the old "Search First" flag did, more or less, probably. LDAP?

Specifically, the issue at heart here is that some LDAP servers require totally uncredentialed binds, some require "anonymous" binds (not sure if this is a term of art or if whoever contributed the first LDAP patch made it up), and some require full DN binds. This flag lets us distinguish between the "full DN" and "completely uncredentialed" use cases, both of which have no "anonymous" credentials.

Test Plan: It compiles!

Reviewers: Firehed

Reviewed By: Firehed

Subscribers: epriestley

Maniphest Tasks: T3208

Differential Revision: https://secure.phabricator.com/D8722
Provide slightly better cURL debugging instructions for custom.pem files

Summary: Some context in IRC. We can slightly improve users' chances of catching issues here, maybe.

Test Plan: read it; ran commands

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8740
Support file attachments on HTTPSFuture

Summary: @zeeg wants this for some build stuff and we'd like it in general to make Mailgun work better. It's a bit messy because of how cURL works. See pages of comments inline.

Test Plan:
  - Added tests for the parser stuff.
  - Made various requests with and without file attachments and saw them encode data as expected.
  - Made some dangerous requests (with "@") and saw them fail.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley, zeeg

Differential Revision: https://secure.phabricator.com/D8831
Censor URIs in service profile log

Summary: Mailgun requests can hit a credentialed URI. Censor credentials from `--trace` URIs.

Test Plan: Ran `bin/mail send-test ... --trace` and saw censored credentials.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8833
Latest xhpast for Windows

Summary: This is the latest version of xhpast built from HEAD using MinGW

Test Plan: Ran 'arc liberate' on Windows, it didn't complain about xhpast missing or out of date

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D8843
Make PhutilGitURI and PhutilURI strict about leading whitespace

Summary: Fixes T4913. We silently accept git and normal URIs with leading spaces, but other systems will not accept these. Instead, fail to parse these so they don't get into the system if we're validating URIs.

Test Plan: {F148680}

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4913

Differential Revision: https://secure.phabricator.com/D8897
Make Phobject detect iteration of non-iterable objects

Summary:
See D8914 and IRC. The root issue was that this code:

  foreach ($some_object as $thing) {
    // ...
  }

...means "iterate over the public properties of the object" in PHP, and does not raise any warnings or throw an exception.

This has very nearly bitten me several times too; we //never// want to do this. Instead, throw from objects extending Phobject.

Test Plan:
  - Added and ran unit tests.
  - Tried to foreach() an arbitrary object.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D8915
Merge remote-tracking branch 'upstream/master'

Conflicts:
	src/future/http/HTTPSFuture.php