tls: proper .destroySoon

1. Emit `sslOutEnd` only when `_internallyPendingBytes() === 0`.
2. Read before checking `._halfRead`, otherwise we'll see only previous
   value, and will invoke `._write` callback improperly.
3. Wait for both `end` and `finish` events in `.destroySoon`.
4. Unpipe encrypted stream from socket to prevent write after destroy.
repl: fix JSON.parse error check

Before this, entering something like:

> JSON.parse('066');

resulted in the "..." prompt instead of displaying the expected
"SyntaxError: Unexpected number"
doc: remove `bufferSize` option

`bufferSize` option has been removed in b0f6789.
npm: Upgrade to 1.2.24
2013.05.30, Version 0.10.9 (Stable)

* npm: Upgrade to 1.2.24

* uv: Upgrade to v0.10.9

* repl: fix JSON.parse error check (Brian White)

* tls: proper .destroySoon (Fedor Indutny)

* tls: invoke write cb only after opposite read end (Fedor Indutny)

* tls: ignore .shutdown() syscall error (Fedor Indutny)
Merge branch 'v0.10.9-release' into v0.10
Now working on v0.10.10
stream: unshift('') is a noop

In some cases, the http CONNECT/Upgrade API is unshifting an empty
bodyHead buffer onto the socket.

Normally, stream.unshift(chunk) does not set state.reading=false.
However, this check was not being done for the case when the chunk was
empty (either `''` or `Buffer(0)`), and as a result, it was causing the
socket to think that a read had completed, and to stop providing data.

This bug is not limited to http or web sockets, but rather would affect
any parser that unshifts data back onto the source stream without being
very careful to never unshift an empty chunk.  Since the intent of
unshift is to *not* change the state.reading property, this is a bug.

Fixes #5557
Fixes LearnBoost/socket.io#1242
url: Properly parse certain oddly formed urls

In cases where there are multiple @-chars in a url, Node currently
parses the hostname and auth sections differently than web browsers.

This part of the bug is serious, and should be landed in v0.10, and
also ported to v0.8, and releases made as soon as possible.

The less serious issue is that there are many other sorts of malformed
urls which Node either accepts when it should reject, or interprets
differently than web browsers.  For example, `http://a.com*foo` is
interpreted by Node like `http://a.com/*foo` when web browsers treat
this as `http://a.com%3Bfoo/`.

In general, *only* the `hostEndingChars` should be the characters that
delimit the host portion of the URL.  Most of the current `nonHostChars`
that appear in the hostname should be escaped, but some of them (such as
`;` and `%` when it does not introduce a hex pair) should raise an
error.

We need to have a broader discussion about whether it's best to throw in
these cases, and potentially break extant programs, or return an object
that has every field set to `null` so that any attempt to read the
hostname/auth/etc. will appear to be empty.
url: Set href to null by default
blog: Release v0.10.9
blog: Release v0.8.24
blog: 0.8 is maintenace, not stable
doc: ChangeLog update for v0.8.24
npm: Upgrade to 1.2.25
url: remove unused global variable
uv: Upgrade to 0.10.10
2013.06.04, Version 0.10.10 (Stable)

* uv: Upgrade to 0.10.10

* npm: Upgrade to 1.2.25

* url: Properly parse certain oddly formed urls (isaacs)

* stream: unshift('') is a noop (isaacs)
Merge branch 'v0.10.10-release' into v0.10
blog: Release v0.10.10