We support all of the following (in TOML notation):

```
user = "rose"  # by name
user = 413     # by ID
user = false   # no user
user = ":current"  # A 'special' user.

user = { name: "rose" }
user = { id: 413 }
user = { special: ":none" }
user = { special: ":current" }
```

The Group and User (de)serialization is pretty ugly, and I can't
vouch for the correcness of MistrustBuilder.  I will seek feedback
before I proceed.

This will help make the actual configuration more serializable,
I hope.

This is an approximately minimal revision to get Builder in place;
subsequent commits will clean up the API.

This renaming will make things slightly simpler for declaring a
builder.

Update to newer sanitize-filename and tinystr.

See merge request tpo/core/arti!523

Make clippy +nightly pass again

See merge request tpo/core/arti!522

It's a little overzealous sometimes, but it's mostly to the good.

These are warnings that we've decided it's okay to suppress elsewhere.

Remove dbg!()s in tor-config, and fix nightly CI

See merge request tpo/core/arti!516

async-compression minimum version 0.3.5 -> 0.3.14

Closes #473

See merge request tpo/core/arti!521

add unit tests for arti_client::StreamPrefs

See merge request tpo/core/arti!520

0.3.14 is the first released version to include
https://github.com/Nemo157/async-compression/commit/e7246738762de34bbb820662c3923f8f2610ac95,
which fixes tpo/core/arti#473

this change adds unit tests for the public methods of StreamPrefs. although
these are mostly "setter" style functions, the tests confirm the basic
expectations and operation.

channel: Provide and use Sink::prepare_send_from

See merge request tpo/core/arti!514

I think this is worse code, but it's not *significantly* worse.

I intend to reintroduce this in its own MR.

So we can change unwrap to expect, which makes this too long to repeat.

Apropos review.

When I added these tests, they didn't find any bugs in my own
implementation, but I did find a bug in futures::future::unfold.
See the in-code comment.

This is a general-purpose implementation of the ad-hoc approach
currently taken in (eg) crates/tor-proto/src/channel/reactor.rs,
with an API intended to defned against the more obvious mistakes.

This allows us to separate the two concerns: the channel reactor can
focus on handling channel cells and control messages and is over 2.5x
shorter.

The complexity of the manual sink implementation, and the machinery
needed to avoid having to suspend while holding an item, are dealt
with separately.  That separate implemenation now has proper
documentation.  (Tests are in the nest commit to avoid this one being
even more unwieldy.)

We use `extend` to define this as an extension trait.  A competitor is
`ext` but in my personal projects I have found `extend` slightly
better.

see https://gitlab.com/gitlab-org/gitlab/-/issues/344533

async-compression v0.3.12 -> v0.3.14

Closes #473

See merge request tpo/core/arti!517

This is to pick up
https://github.com/Nemo157/async-compression/pull/148#issuecomment-1128862482

Fixes tpo/core/arti#473

This should satisfy our CI and turn it green again.

DirMgr: Revise error handling to better tolerate reset-able failures

Closes #412 and #439

See merge request tpo/core/arti!511

It does nothing that Fatal does not.  Suggested by @eta in review.

We no longer have separate return paths for recoverable and fatal
errors; instead, they are merged, and distinguished based on
recovery actions.

Since it is now possible for download() to give an error that should
_not_ destroy the previous state, it takes `&mut Box<dyn DirState>`.
This change unfortunately means that we can no longer call `state =
state.advance()`, but instead have to do some mem::swap junk with
poisoned values.  Any better solution would be a good thing.

Additionally, the reset() and advance() methods can no longer fail.

There is still a separate return path for reset-triggering errors;
I'm about to fix that.

Do backtrace string matching test only on some platforms.

See merge request tpo/core/arti!512