add timingsafe string functions, updates

 * updated to latest upstream, add more __bounded__ exceptions
 * added direct imports from openbsd libc and regression tests
 * added timingsafe memcmp/bcmp
replace compat/rand_lib.c with a thin arc4random_buf wrapper on top of libottery

this allows us to use the OS arc4random_buf as-needed
added explicit_bzero test
added pq_test
autogen updates to the library version