Make the other functions in lock.s return an error code, too.

We make tdb_brlock() and tdb_lock_gradual() return an error code directly:
the callers have to set tdb->ecode. 

I use the "high pointers hold error numbers" trick, and also make
tdb_logerr return the error code, which enables the common case of
"return tdb_logerr(...)".

This prepares us for changing function returns over.

It's not actually different from tdb_traverse().  We can re-add it later if
it makes sense.

We do this lower down anyway.

It doesn't help the user, since they can't use it to declare their hash
function, and it just adds a level of mental indirection for us.

We don't actually support it, so take it away for the moment.  If you
try to nmest you get a TDB_LOG_USE_ERROR message.

It was never clear to me which levels should be used for what cases.
I can only usefully distinguish three at the moment:
(1) TDB errors, which render the TDB unreliable.
(2) TDB user errors, caused by API misuse.
(3) TDB notifications of strange behaviour, from which we have recovered.

Gets us one extra ccanlint point, too.

This should never happen.

Log it at level ERROR and log the raw unformatted message at the requested
level.

This is a fairly sophisticated use of failtest:
1) There are a few places where we can inject failures without revealing it
   at the API level, eg. opening /dev/urandom, or allocation failure in logging.
2) We want to be sure that (almost) all failures cause a message to be logged.
3) We need to exit as soon as possible when a failure is injected, to avoid
   combinatorial explosion.
4) We don't want to simply exit on any log message, since we want to be sure
   that cleanup happens.

This test found four different bugs failure paths.  Erk!

Since failtest uses macros to override read and write, we need to avoid
those names, even inside our ops structure.

On normal files, pwrite and write should never return short except on error.
As we never create sparse files, so any short write is an I/O error.

Simply assume that any short read on a TDB in an I/O error.

Do it properly, with a printf-style interface.

Especially since they probably define _GNU_SOURCE.

Otherwise we don't get goodies like asprintf, and 64-bit offsets.  Should
be a harmless-define on non-glibc systems.

We run in a temporary directory now.  Also, avoids warning and memory leak.

And use those names, too.

Old habits die hard; it's better to use #if <FEATURE> than #ifdef <FEATURE>;
they're similar, because undefined identifiers evaluate to zero, but with
GCC's -Wundef flag you can detect mis-spelled or missing features with
#if.

autoconf-style config.h leave unset features undefined, so this works for
those config.h too.

A common mistake is not to try compiling with features disabled in
config.h.  The ideal case would determine how features interact and
test all combinations of them: this simply disables any features
mentioned in the code which were previously enabled.

This means you don't have to recompile ccanlint to get the new flags;
it's a small step towards making ccanlint useful outside the ccan repo.

David Gibson reports (and I confirmed) that running ccanlint in /tmp
causes an very uninformative segv.  Fix that, and add a more useful message,
as well as delaying recursing until we're confident there's code around.

Andreas Schlick reports that PaX et. al. dislike trampolines, so open-code
qsort from glibc.

Interestingly, _quicksort from glibc seems to have a void * parameter, but
I can't find any information on it.