Avoid a segfault on getblock if it can't read a block from disk.
Clean up RPCs that are disabled in safe-mode.

This removes some inconsistencies in what worked and didn't work in
 safemode. Now only RPCs involved in getting balances or sending
 funds are disabled.

Previously you could mine but not submit blocks— but we may need more
 blocks to resolve a fork that triggered safe mode in the first place,
 and the non-submission was not reliable since some miners submit
 blocks via multiple means. There were also a number of random commands
 disabled that had nothing to do with the blockchain like verifymessage.

Thanks to earlz for pointing out that there were some moderately cheap
 ways to maliciously trigger safe mode, which brought attention to
 the fact that safemode wasn't used in a very intelligent way.
Merge pull request #4501

954d2e7 Avoid a segfault on getblock if it can't read a block from disk. (Ruben Dario Ponticelli)
Merge pull request #4507

b60be6b Clean up RPCs that are disabled in safe-mode. (Gregory Maxwell)
`getrawchangeaddress` should fail when keypool exhausted

An user on IRC reported an issue where `getrawchangeaddress`
keeps returning a single address when the keypool is exhausted.
In my opinion this is strange behaviour.

- Change CReserveKey to fail when running out of keys in the keypool.
- Make `getrawchangeaddress` return RPC_WALLET_KEYPOOL_RAN_OUT when
  unable to create an address.
- Add a Python RPC test for checking the keypool behaviour in combination
  with encrypted wallets.
Merge pull request #4347

6c37f7f `getrawchangeaddress` should fail when keypool exhausted (Wladimir J. van der Laan)
Only keep setBlockIndexValid entries that are possible improvements
Only remove actualy failed blocks from setBlockIndexValid
Headers-first synchronization

Many changes:
* Do not use 'getblocks', but 'getheaders', and use it to build a headers tree.
* Blocks are fetched in parallel from all available outbound peers, using a
  limited moving window. When one peer stalls the movement of the window, it is
  disconnected.
* No more orphan blocks. At all. We only ever request a block for which we have
  verified the headers, and store it to disk immediately. This means that a
  disk-fill attack would require PoW.
* Some new fields in getpeerinfo:
  * 'syncheight': the height up to which we've validated this peer's headers.
  * 'commonheight': the height up to which we have all blocks in common with
                    this peer.
  * 'inflight': the heights we're currently requesting from this peer.
* Require protocol version 31800 for every peer (released in december 2010).
* No more syncnode (we sync from everyone we can, though limited to 1 during
  initial *headers* sync).
* Introduce some extra named constants and comments.
* Several bugfixes:
  * CChain::GetLocator() didn't work correctly across the CChain end.
  * FindMostWorkChain() failed to remove the actually failed block from
    setBlockIndexValid.
  * ProcessMessage() failed to act on ban/reject notices resulting from
    validation failures during the direct execution (CheckBlock, ...).

This breaks reindexing, which cannot yet deal with out-of-order blocks on disk.