add OpenSSL RAND_cleanup() on OpenSSL shutdown

- to securely erase the memory used by the PNRG
- also rework 2 comments in OpenSSL init
Add support for watch-only addresses

Changes:
* Add Add/Have WatchOnly methods to CKeyStore, and implementations
  in CBasicKeyStore.
* Add similar methods to CWallet, and support entries for it in
  CWalletDB.
* Make IsMine in script/wallet return a new enum 'isminetype',
  rather than a boolean. This allows distinguishing between
  spendable and unspendable coins.
* Add a field fSpendable to COutput (GetAvailableCoins' return type).
* Mark watchonly coins in listunspent as 'watchonly': true.
* Add 'watchonly' to validateaddress, suppressing script/pubkey/...
  in this case.

Based on a patch by Eric Lombrozo.

Conflicts:
	src/qt/walletmodel.cpp
	src/rpcserver.cpp
	src/wallet.cpp
qt: Hide unspendable outputs in coin control
Watchonly balances are shown separately in gui.
Watchonly transactions are marked in transaction history
Added argument to getbalance to include watchonly addresses and fixed errors in balance calculation.
Added argument to listaccounts to include watchonly addresses
Showing 'involvesWatchonly' property for transactions returned by 'listtransactions' and 'listsinceblock'.
It is only appended when the transaction involves a watchonly address.
Added argument to listtransactions and listsinceblock to include watchonly addresses
fixed tiny glitch and improved readability like laanwj suggested
added includeWatchonly argument to 'gettransaction' because it affects balance calculation
added includedWatchonly argument to listreceivedbyaddress/...account
Use script matching rather than destination matching for watch-only.

This changes the keystore data format, wallet format and IsMine logic
to detect watch-only outputs based on direct script matching rather
than first trying to convert outputs to destinations (addresses).

The reason is that we don't know how the software that has the spending
keys works. It may support the same types of scripts as us, but that is
not guaranteed. Furthermore, it removes the ambiguity between addresses
used as identifiers for output scripts or identifiers for public keys.

One practical implication is that adding a normal pay-to-pubkey-hash
address via importaddress will not cause payments to the corresponding
full public key to be detected as IsMine. If that is wanted, add those
scripts directly (importaddress now also accepts any hex-encoded script).

Conflicts:
	src/wallet.cpp
removed default argument values for ismine filter
Fixed some stuff in TransactionDesc
Added MINE_ALL = (spendable|watchonly)
fixed bug in ListReceived()
fixed bug where validateaddress doesn't display information
replaced MINE_ with ISMINE_
rpc: Prevent easy memory exhaustion attack

Allocate memory for POST message data only as bytes come in, instead of
all at once at the beginning.

Fixes #4343.