Discourage NOPs reserved for soft-fork upgrades

NOP1 to NOP10 are reserved for future soft-fork upgrades. In the event
of an upgrade such NOPs have *VERIFY behavior, meaning that if their
arguments are not correct the script fails. Discouraging these NOPs by
rejecting transactions containing them from the mempool ensures that
we'll never accept transactions, nor mine blocks, with scripts that are
now invalid according to the majority of hashing power even if we're not
yet upgraded. Previously this wasn't an issue as the IsStandard() rules
didn't allow upgradable NOPs anyway, but 7f3b4e95 relaxed the
IsStandard() rules for P2SH redemptions allowing any redeemScript to be
spent.

We *do* allow upgradable NOPs in scripts so long as they are not
executed. This is harmless as there is no opportunity for the script to
be invalid post-upgrade.
Update comments in src/rpc* to be doxygen compatible
build: make a distinction between static app ldflags and static lib ldflags

For windows builds, exe's are always static, but libs should still conform to
--enabled-shared and --enable-static.
build: mingw needs libssp for hardening with dlls
build: check visibility attributes
build: remove internal/protected build attribute checks

They're not necessary, and not always supported. We only need to know about
hidden and default.
build: add libbitcoinconsensus files and hook up the lib build

Credit BlueMatt for libbitcoinsonsensus.h/cpp
build: add --with-libs so that libs are optional
build: add quick consensus lib tests

They should be hooked up in other places as well, but this is a start.
build: shared lib build should work reasonably well now
build: fix static dll link for mingw

dll's are no longer dynamically linked to libgcc/libstdc++/libssp
build: pad header for osx libs

This ensures that users of the lib will be able to mangle the paths to work
in their bundles.
Check block header before accepting it.

Previously, AcceptBlockHeader did not check the header (in particular
PoW).  This made the client accept invalid-PoW-headers from peers in
headers-first sync.
qt: Make askpassphrase dialog behave more sanely

Set minimum sizes appropriately, and make sure that they
are enforced. Replaces #5226.
Merge pull request #5235

9eb5a5f build: pad header for osx libs (Cory Fields)
9ed8979 build: fix static dll link for mingw (Cory Fields)
19df238 build: shared lib build should work reasonably well now (Cory Fields)
269efa3 build: add quick consensus lib tests (Cory Fields)
cdd36c6 build: add --with-libs so that libs are optional (Cory Fields)
2cf5f16 build: add libbitcoinconsensus files and hook up the lib build (Cory Fields)
ee64c53 build: remove internal/protected build attribute checks (Cory Fields)
f36a40f build: check visibility attributes (Cory Fields)
811a765 build: mingw needs libssp for hardening with dlls (Cory Fields)
e0077de build: make a distinction between static app ldflags and static lib ldflags (Cory Fields)
Merge pull request #5320

e0a25c5 qt: Make askpassphrase dialog behave more sanely (Wladimir J. van der Laan)
Merge pull request #5324

72fb3d2 Update comments in src/rpc* to be doxygen compatible (Michael Ford)
Merge pull request #5000

0391423 Discourage NOPs reserved for soft-fork upgrades (Peter Todd)
Merge pull request #5270

57425a2 Check block header before accepting it. (Daniel Kraft)
Add new command line option '-maxoutbound'

While there is a command line option to limit the total number of
connections ('-maxconnections'), the number of outbound connections is
controlled by a hard-coded constant 'MAX_OUTBOUND_CONNECTIONS=8'.
This number (8) of connections has a bad impact on user's privacy. Let's
keep the default number of outbound connections (of 8) but allow a user
to have more privacy by reducing this number (to 3 or 4) using
'-maxoutbound'.

Explanation: transactions that are first relayed by these 8 entry nodes
most probably belong to the same user. In fact, even a subset of these 8
entry nodes can uniquely identify a user. There is a cheap way for an
attacker to learn this set of entry nodes and the user's public IP and
use it to deanonymize the user (note that users by default advertise
their public IP addresses even when behind NAT).  If the user has 3-4
outbound connection the success rate of the attack becomes quite low.