osx: fix signing to make Gatekeeper happy (again)

The approach from 65f3fa8d1 worked for signing on 10.9.4, but not newer
versions. 10.9.5 (and up) want each framework to stand alone.

Now in addition to copying the plist's from Qt for each framework, we put them
in per-version dirs and only symlink to the latest, rather than using symlinks
for any contents.
Fix formatting in  init.md
depends: update the comparison tool to a more recent version
Revert "travis: retry tests before giving up"

This reverts commit 7e3821c097c05a4790abac53ddd26ef28cb7cf4d.
tests: fix python test-runner for windows

Windows needed a few fixups to get the tests running:
1. bitcoin-tx needs a file extension in Windows. Take this opportunity to
   add an env file, which pulls variables out of our build config. This can
   be extended as needed, for now it's very simple.
2. After #1, split the args out of the exec key in the test data.
3. Correct the line-endings from windows stdout
tests: fix false-positive under win64

BN_ULONG isn't necessarily an unsigned long, as is the case on win64.
Merge pull request #5006 from TheBlueMatt/travis-new-comparisontool

depends: update the comparison tool to a more recent version
Update build-unix.md

Debian also need libboost-all-dev installed.
Merge pull request #5015 from theuni/win64test

tests: fix false-positive under win64
Merge pull request #5014

41d67c7 tests: fix python test-runner for windows (Cory Fields)
Merge pull request #5018

347a3a3 Update build-unix.md (JL2035)
Merge pull request #5005

af0bd5e osx: fix signing to make Gatekeeper happy (again) (Cory Fields)
Merge pull request #5008

41020eb Fix formatting in  init.md (Whit J)
Do merkle root and txid duplicates check simultaneously

Move the txid duplicates check into BuildMerkleTree, where it can be done
much more efficiently (without needing to build a full txid set to detect
duplicates).

The previous version (using the std::set<uint256> to detect duplicates) was
also slightly too weak. A block mined with actual duplicate transactions
(which is invalid, due to the inputs of the duplicated transactions being
seen as double spends) would trigger the duplicates logic, resulting in the
block not being stored on disk, and rerequested. This change fixes that by
only triggering in the case of duplicated transactions that can actually
result in an identical merkle root.
Headers-first synchronization

Many changes:
* Do not use 'getblocks', but 'getheaders', and use it to build a headers tree.
* Blocks are fetched in parallel from all available outbound peers, using a
  limited moving window. When one peer stalls the movement of the window, it is
  disconnected.
* No more orphan blocks. At all. We only ever request a block for which we have
  verified the headers, and store it to disk immediately. This means that a
  disk-fill attack would require PoW.
* Require protocol version 31800 for every peer (released in december 2010).
* No more syncnode (we sync from everyone we can, though limited to 1 during
  initial *headers* sync).
* Introduce some extra named constants, comments and asserts.

This breaks reindexing, which cannot yet deal with out-of-order blocks on disk.
RPC additions after headers-first
Remove CheckMinWork, as we always know all parent headers
Improve getheaders (sending) logging
Better logging of stalling
Add height to "Requesting block" debug