Our BUG macro definition is all wrong for coverity. We shouldn't be including __coverity_panic__, since hitting a BUG doesn't actually mean Tor will crashed, and we shouldn't imply that the condition might be visited anyway. We should just do "#define BUG(x) (x)" when we're building with coverity.