Extend kj::Network interface for easy SSRF protection

Clarify the RPC spec in some places

Add gzip (zlib) bindings.

E.g.:

    "foo"_kj

This literal will have type StringPtr. Although any string literal can implicitly cast to StringPtr, using the _kj suffix has the advantage that it can be constexpr.

ubsan: cast to unsigned integer before performing left shift

Implement TLS option to verify client certificates.

Use case for me is Cloudflare's "Authenticated Origin Pulls", in which Cloudflare authenticates itself to the origin server using client certificates. Thus the origin server can ensure that it only accepts traffic through Cloudflare, without resorting to IP whitelists.

This really is more of a data structure than a resource type, and it's useful to be able to share it between threads and whatnot.

buffers passed to PackedOutputStream::write() must be word-aligned

avoid passing invalid reference to Array<T> constructor

ubsan complains about the invalid reference even if it is unused.

RPC: Support abstract unix socket addresses on Linux

Add WebSocket support to HTTP library

Based on discussions in the Google group:

https://groups.google.com/forum/#!topic/capnproto/_1kBtRSC51s

The proxying code was responding to a `Close` message by ending the pump loop, which had the effect of immediately dropping the connection after a `Close` had been seen in each direction. This is arguably incorrect behavior: for proxying purposes, `Close` messages and underlying TCP disconnects should be treated as independent events, forwarded separately.

In practice this "bug" probably would never cause a problem and perhaps doesn't even violate spec (since `Close` was seen in both directions). But, OSX's implementation of shutdown() returns ENOTCONN if the connection has already been disconnected from the remote end. This is the case here, as the proxy dropped all connections immediately after sending the final `Close`.

This in turn led to a unit test failure.

The intended behavior was that the proxy would forward exactly what it saw: If a `Close` was sent, it would be forwarded, without changing the underlying connection state. If a TCP disconnect was detected, it would be "forwarded" by disconnecting the next leg. This change implements that behavior.