Add fish_tests target to Xcode build

Allows running the tests in Xcode
Don't try to colorize errors when running in Xcode
Don't show "and 1 more rows" in pager if that requires a row
Accepting an autosuggestion should clear the pager
Make __fish_print_users work on OS X via dscl
Strip users with leading underscores from ssh completions
Use sgrep instead of grep in ssh completion
Support for command wrapping ("aliases")

Add the --wraps option to 'complete' and 'function'. This allows a
command to (recursively) inherit the completions of a wrapped command.
Fixes #393.

When evaluating a completion, we inspect the entire "wrap chain" for a
command, i.e. we follow the sequence of wrapping until we either hit a
loop (which we silently ignore) or the end of the chain. We then
evaluate completions as if the wrapping command were substituted with
the wrapped command. Currently this only works for commands, i.e.
'complete --command gco --wraps git\ checkout' won't work (that would
seem to encroaching on abbreviations anyways). It might be useful to
show an error message for that case.

The commandline builtin reflects the commandline with the wrapped
command substituted in, so e.g. git completions (which inspect the
command line) will just work. This sort of command line munging is
also performed by 'complete -C' so it's not totally without precedent.

'alias will also now mark its generated function as wrapping the
'target.
Make escape_string transform wildcard characters

The characters ANY_CHAR, ANY_STRING, and ANY_STRING_RECURSIVE are
currently transformed by unescape, but not by escape. Let's try escaping
them. Fixes #1614.
set: Print an error when setting `umask` to a bad value

Repurpose the ENV_INVALID return value for env_set(), which wasn't
currently used by anything. When a bad value is passed for the 'umask'
key, return ENV_INVALID to signal this and print a good error message
from the `set` builtin.

This makes `set umask foo` properly produce an error.
doc: Fix links in "Further help and development"

Hyperlink the mailing list to the proper info page.

Tweak the GitHub link to use https.
doc: Fix docs on $HOME/$USER

The docs claimed that the $HOME and $USER variables could only be
changed by the root user. This is untrue. They can be changed by
non-root users as well.
doc: Document how IFS affects command substitution

IFS is used for more than just the read builtin. Setting it to the empty
string also disables line-splitting in command substitution, and it's
done this for the past 7 years. Some day we may have a better way to do
this, but for now, document the current solution.
Clean up the IFS handling in command substitution

Remove the useless ASCII test of the first byte of IFS. We don't split
on the first character, we only use a non-empty IFS as a signal to split
on newlines.
webconfig: Use a constant-time token comparison

This prevents a linear-time attack to recover the auth token.
webconfig: fixes for token security

 * Use 16-byte tokens
 * Use os.urandom (random.getrandbits shouldn't be used for security)
 * Convert to hex correctly