They use the same code as reporting assertion failures, so we should
invert the sense of what we're "asserting".

Fixes bug 20093.

We wanted to make sure -50 was a bad input, but instead we were
passing a 'min' that was greater than 'max'.

The functions it warns about are:
  assert, memcmp, strcat, strcpy, sprintf, malloc, free, realloc,
  strdup, strndup, calloc.

Also, fix a few lingering instances of these in the code. Use other
conventions to indicate _intended_ use of assert and
malloc/realloc/etc.

Requires a recent version of chutney.

Also remove bridges+hs, as it's somewhat redundant.

When allowing private addresses, mark Exits that only exit to private
locations as such. Fixes bug 20064; bugfix on 0.2.2.9-alpha.

Please remember to test your code with
--enable-expensive-hardening. :)

(Rationale: it isn't a bug to try this for a base16 or base64
string. It's just a bad input that we're detecting.)

We should consider them bugs.  If they are happening intentionally,
we should use the log_test_helpers code to capture and suppress
them.  But having them off-by-default has potential to cause
programming errors.

This isn't valid behavior, and it causes a crash when you run
the unit tests at --debug.

I've added an IF_BUG_ONCE() check for this case.

In addition to documentation, this commit makes a function static,
and removes a weird single-point-of-return-ism, and notes a thing I
should fix.

Previously setup_capture_of_logs would prevent log messages from
going to the console entirely.  That's a problem, since sometimes
log messages are bugs!  Now setup_capture_of_logs() acts sensibly.

If you really do need to keep a message from going to the console
entirely, there is setup_full_capture_of_logs().  But only use that
if you're prepared to make sure that there are no extraneous
messages generated at all.

Otherwise it's too easy to lose our test coverage.