Way back in 538a767e I added `RpcSystem::setFlowLimit()`, a blunt mechanism by which an RPC node can arrange to stop reading new messages from the connection when too many incoming calls are in-flight. This was needed to deal with buggy Sandstorm apps that would stream multi-gigabyte files by doing a zillion writes without waiting, which would then all be queued in the HTTP gateway, causing it to run out of memory.

In implementing that, I inadertently caused the RPC system to do a tree walk on every call message it received, in order to sum up the message size. This is silly, becaues it's much cheaper to sum up the segment sizes. In fact, in the case of a malicious peer, the tree walk is potentially insufficient, because it doesn't count holes in the segments. The tree walk also means that any invalid pointers in the message cause an exception to be thrown even if that pointer is never accessed by the app, which isn't the usual behavior.

I seem to recall this issue coming up in discussion once in the past, but I couldn't find the thread.

For the new streaming feature, we'll be paying attention to the size of outgoing messages. Again, here, it would be nice to compute this size by summing segments without doing a tree walk.

So, this commit adds `sizeInWords()` methods that do this.

Add OpenBSD to posix_memalign ifdef

Introduce kj::attachVal(), kj::attachRef(), and capnp::clone() utility functions

Add TwoPartyServer::drain().

This is frequently needed. Sandstorm had `OwnCapnp` for this purpose:

https://github.com/sandstorm-io/sandstorm/blob/4d86a8144cdb43120ea12845738d0fe4a6ffcda1/src/sandstorm/util.h#L495-L525

The Workers codebase has some ad-hoc copies of this logic too, and multiple people have requested something similar on the mailing list.

This is a lot like Own<T>::attach() but for the case where you don't have a Own pointer, you just have a reference or value that you want to attach stuff to.

Align HTTP entity-body delimiting rules with RFC 7230.

Skip test that fails under qemu-user, probably due to a qemu bug.

The main case where the code was wrong is when neither Content-Length nor Transfer-Encoding was provided on a response. In this case the response is delimited by closing the connection, but KJ previously rejected it outright. AFAICT almost no one on the whole internet relies on this anymore... almost.

Fix exclusiveJoin() bug when both branches complete simultaneously.

Implement FD passing in Cap'n Proto. 

Fix uninitialized byte arrays in encoding-test.

Initializer lists are temporaries. The code apparently works in debug mode but fails when optimized.

Add support for url-safe base64 encoding

Fix bug in `kj::newOneWayPipe(0)`.

Fix typos spotted by @a-robinson and update test failure messages to indicate that either testing failing could be due to OS SCM_RIGHTS truncation bug.

According to David Klempner, this turns out not to be a safe assumption:

https://twitter.com/CaptainSegfault/status/1112622245531144194

Interestingly, it turns out this optimization was also blocking the delivery of certain errors, because we would skip the read() where that error would otherwise be delivered. (Hence the unit test update.)

An endpoint (subclass of `Capability::Server`) may override `kj::Maybe<int> getFd()` to expose an underlying file descriptor.

A remote client may use `Capability::Client::getFd()` on the endpoint's capability to get that FD.

The client and server must explicitly opt into FD passing by passing a max-FDs-per-message limit to TwoPartyVatNetwork and using Unix sockets as the transport. Nothing other than that is needed.