Support hairpin NAT without going through docker server

Hairpin NAT is currently done by passing through the docker server.  If
two containers on the same box try to access each other through exposed
ports and using the host IP the current iptables rules will not match the
DNAT and thus the traffic goes to 'docker -d'

This change drops the restriction that DNAT traffic must not originate
from docker0.  It should be safe to drop this restriction because the
DOCKER chain is already gated by jumps that check for the destination
address to be a local address.

Docker-DCO-1.1-Signed-off-by: Darren Shepherd <darren.s.shepherd@gmail.com> (github: ibuildthecloud)
Resync the DCO text with upstream at http://developercertificate.org/

```
Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.
```

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Add authenticated TLS support for API

Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
move git clone from daemon to client

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)

add a little doc
if client has no git, use server

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Add initial logging to libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Add stderr log ouput if in debug
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
update godoc and add MAINTAINERS for mflags

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Fix spelling of benchmark test

Docker-DCO-1.1-Signed-off-by: Paul Nasrat <pnasrat@gmail.com> (github: pnasrat)
Add proper support for relative WORKDIR instructions

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Fix external link on security of containers

Docker-DCO-1.1-Signed-off-by: Vladimir Rutsky <altsysrq@gmail.com> (github: rutsky)
In `docker ps`, sort by port instead of unsorted.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <erik@hollensbe.org> (github: erikh)
Fix `docker cp` trying to untar files that do not exist.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <erik@hollensbe.org> (github: erikh)
Merge pull request #4698 from rutsky/external_link_in_rst_fix

Fix external link on security of containers
Merge pull request #4672 from vieux/update_godoc_mflags

update godoc and add MAINTAINERS for mflags
fix content-type detection in docker cp

Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Merge pull request #4686 from pnasrat/benchmark-typo

Fix spelling of benchmark test
Merge pull request #4700 from erikh/2371-sort_ports

In `docker ps`, sort by port instead of unsorted.
refactor(libcontainer): rename to CapabilitiesMask

The Capabilities field on libcontainer is actually used as a mask.
Rename the field so that this is more clear.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
chore(libcontainer): small grammar fix in types_test

Someone probably got really used to typing er on the end of contain :)

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)