http: invoke createConnection when no agent

This makes it so that the user may pass in a
`createConnection()` option, and they don't have
to pass `agent: false` at the same time.

Also adding a test for the `createConnection` option,
since none was in place before.

See #7014.
test: add `agent: null` http client request test

This is just the test portion from #7012 / #7189,
but targetted for the v0.10 branch.
src: domain should not replace nextTick function

Previously if you cached process.nextTick and then require('domain')
subsequent nextTick() calls would not be caught because enqueued
functions were taking the wrong path. This keeps nextTick to a single
function reference and changes the implementation details after domain
has been required.
timer: don't reschedule timer bucket in a domain

If two timers run on the same tick, and the first timer uses a domain,
and then catches an exception and disposes of the domain, then the
second timer never runs. (And even if the first timer does not dispose
of the domain, the second timer could run under the wrong domain.)

This happens because timer.js uses "process.nextTick()" to schedule
continued processing of the timers for that tick. However, there was
an exception inside a domain, then "process.nextTick()" runs under
the domain of the first timer function, and will do nothing if
the domain has been disposed.

To avoid this, we temporarily save the value of "process.domain"
before calling nextTick so that it does not run inside any domain.
src: add default visibility to NODE_MODULE

It's currently not really possible to compile native add-ons with
-fvisibility=hidden because that also hides the struct containing
the module definition.

The NODE_MODULE() and NODE_MODULE_DECL() macros are structured in
a way that makes it impossible to add a visibility attribute manually
so there is no escape hatch there.

That's why this commit adds an explicit visibility attribute to
the module definition.  It doesn't help with node.js releases that
are already out there but at least it improves the situation going
forward.
test: test sending a handle twice

Added test-cluster-send-handle-twice.js testing to send a handle
twice to the parent process.
child_process: fix sending handle twice

When sending a socket to a child process via IPC pipe,
`child_process.js` picks a raw UV handle from `_handle` property, sends
it, and assigns `null` to the property. Sending the same socket twice
was resulting in a runtime error, since we weren't handling the empty
`_handle` case.

In case of `null` `_handle` we should send just a plain text message
as passed it was passed to `.send()` and ignore the handle, letting
users handle such cases themselves instead of throwing the error at
runtime.

fix #5469
deps: fix v8 valgrind warning

Fix the following valgrind warning:

    Conditional jump or move depends on uninitialised value(s)
        at 0x7D64E7: v8::internal::GlobalHandles::IterateAllRootsWithClassIds(v8::internal::ObjectVisitor*) (global-handles.cc:613)
        by 0x94DCDC: v8::internal::NativeObjectsExplorer::FillRetainedObjects() (profile-generator.cc:2849)
        # etc.

This was fixed upstream in r12903 and released in 3.15.2 but that commit
was never back-ported to the 3.14 branch that node.js v0.10 uses.

The code itself works okay; this commit simply shuffles the clauses in
an `if` statement to check that the node is in use before checking its
class id (which is uninitialized if the node is not in use.)
crypto: do not lowercase cipher/hash names

`crypto.getCiphers()` and `crypto.getHashes()` should prefer lower-case
variants of names, but should not introduce them.

fix #7282
doc: remove an unused arg in process.stdin.

The argument of process.stdin's readable event handler is not used.
build: fix g++ 4.8 build, disable -Werror

Turn off -Werror when building V8, it hits -Werror=unused-local-typedefs
with g++ 4.8.  The warning itself is harmless so don't abort the build.

This was originally implemented in commit d2ab314e back in 2011 but the
build process has gone through a few iterations since then, that change
no longer works.
npm: upgrade to 1.4.6

* Documentation upgrades
* Fix glob bug which prevents proper README publishing
* node-gyp upgrade to 0.13
* Documentation updates
* Add --save-exact to save an exact dep (instead of a range)
* alias 't' to 'test'
src: seed V8's random number generator at startup

The default entropy source is /dev/urandom on UNIX platforms, which is
okay but we can do better by seeding it from OpenSSL's entropy pool.

On Windows we can certainly do better; on that platform, V8 seeds the
random number generator using only the current system time.

Fixes #6250.

NB: This is a back-port of commit 7ac2391 from the master branch that
for some reason never got back-ported to the v0.10 branch.

The default on UNIX platforms in v0.10 is different and arguably worse
than it is with master: if no entropy source is provided, V8 3.14 calls
srandom() with a xor of the PID and the current time in microseconds.

That means that on systems with a coarse system clock, the initial
state of the PRNG may be easily guessable.

The situation on Windows is even more dire because there the PRNG is
seeded with only the current time... in milliseconds.
src: ensure that openssl's PRNG is fully seeded

Ensure that OpenSSL has enough entropy (at least 256 bits) for its PRNG.

The entropy pool starts out empty and needs to fill up before the PRNG
can be used securely.

OpenSSL normally fills the pool automatically but not when someone
starts generating random numbers before the pool is full: in that case
OpenSSL keeps lowering the entropy estimate to thwart attackers trying
to guess the initial state of the PRNG.

When that happens, we wait until enough entropy is available, something
that normally should never take longer than a few milliseconds.

Fixes #7338.
build: windows signing should include timestamps

Previously the build artifacts did not include a signed timestamp, so
when the certificate expired the validation of the artifact would fail.
Now we sign against a timestamp server such that the artifact will
always be valid regardless of the disposition of the certificate.

Closes #7360 and #7059.
doc: typo clean up in tls
docs: correct tls docs. server -> client

when a pfx file is passed to tls.connection,
it is the client private key, not the server's private key.
doc: add missing space

Signed-off-by: Fedor Indutny <fedor@indutny.com>
http: do not emit EOF non-readable socket

Socket may become not `readable`, but http should not rely on this
property and should not think that it means that no data will ever
arrive from it. In fact, it may arrive in a next tick and, since
`this.push(null)` was already called, it will result in a error like
this:

    Error: stream.push() after EOF
        at readableAddChunk (_stream_readable.js:143:15)
        at IncomingMessage.Readable.push (_stream_readable.js:123:10)
        at HTTPParser.parserOnBody (_http_common.js:132:22)
        at Socket.socketOnData (_http_client.js:277:20)
        at Socket.EventEmitter.emit (events.js:101:17)
        at Socket.Readable.read (_stream_readable.js:367:10)
        at Socket.socketCloseListener (_http_client.js:196:10)
        at Socket.EventEmitter.emit (events.js:123:20)
        at TCP.close (net.js:479:12)

fix #6784
deps: update openssl to 1.0.1g