Improve TCP FIN retransmission handling.

In the case multiple FIN packets are seen from a TCP endpoint (e.g.
when one is retransmitted), only the first counted towards a byte in the
sequence space.  This could cause a subsequent FIN packet to induce an
incorrect wrap around in the sequence numbers (e.g.  the retransmitted
FIN packet now is one sequence number behind the the first) and
misleadingly large connection sizes.  The change is to always treat a
FIN packet as counting one byte in to the sequence space.
Improve gap reporting in TCP connections that never see data.

The previous behavior was to accomodate SYN/FIN/RST-filtered traces by
not reporting missing data (via the content_gap event) for such
connections.  The new behavior always reports gaps for connections that
are established and terminate normally, but sequence numbers indicate
that all data packets of the connection were missed.  The behavior can
be reverted by redef'ing "detect_filtered_trace".
Improve TCP connection size reporting for half-open connections.

If TCP endpoint A and B are synchronized at some point, but A
closes/aborts/crashes and B goes on without knowledge of it and then A
tries to re-synchronize, Bro could end up seeing something like
(sequence numbers made up):

A: SYN 100
B: ACK 500
A: RST 500

The final sequence number of A, in this case, is not useful in the
context of determining the number of data bytes sent by A, so Bro now
reports that as 0 (where before it could often be misleadingly large).
Fix file_over_new_connection event to trigger when entire file is missed.

If a file is nothing but gaps (e.g. due to missing/dropped packets), Bro
can sometimes detect a file is supposed to have been present and never
saw any of its content, but failed to raise file_over_new_connection
events for it.  This was mostly apparent because the tx_hosts/rx_hosts
fields in files.log would not be populated in such cases (but are now
with this change).
Fix x509_extension event.

The event now really returns the extension. If openssl supports printing
it, it is converted into the openssl ascii output.

The output does not always look pretty because it can contain newlines.

New event syntax:
event x509_extension(c: connection, is_orig: bool, cert:X509, extension: X509_extension_info)

Example output for extension:
  [name=X509v3 Extended Key Usage,
    short_name=extendedKeyUsage,
    oid=2.5.29.37,
    critical=F,
    value=TLS Web Server Authentication, TLS Web Client Authentication]
  [name=X509v3 Certificate Policies,
   short_name=certificatePolicies,
   oid=2.5.29.32,
   critical=F,
   value=Policy: 1.3.6.1.4.1.6449.1.2.1.3.4^J  CPS: https://secure.comodo.com/CPS^J]
Merge remote-tracking branch 'origin/topic/bernhard/fix-x509-extensions'

* origin/topic/bernhard/fix-x509-extensions:
  Fix x509_extension event.

BIT-1120 #merged
Merge remote-tracking branch 'origin/topic/jsiwek/tcp-improvements'

* origin/topic/jsiwek/tcp-improvements:
  Fix file_over_new_connection event to trigger when entire file is missed.
  Improve TCP connection size reporting for half-open connections.
  Improve gap reporting in TCP connections that never see data.
  Improve TCP FIN retransmission handling.

BIT-1119
Updating submodule(s).

 [nomail]