add `require client ca' rule to require certs signed by a CA

refactor apply_block_return move the strip and fmt logic to their own function

fix seccomp for the new event loop add/remove syscalls from the BPF filter and move sandbox() after libevent initialisation

rewrite main loop using libevent

define TLS_CLIENT_NOT_BEFORE/NOT_AFTER in CGI scripts

don't fprintf

improve logs management

handle also EAGAIN together with EWOULDBLOCK

add the ``entrypoint'' option

swap check in vhost_* fns it's faster (statistically speaking) to first compute if the option is set and then fnmatch than the inverse. This way we can avoid unnecessary fnmatch.

added ``block return'' and ``strip'' options

fix auto index precedence

reload configuration on SIGHUP

use upper bound given by poll it's a waste to loop through all fds. We know the *exact* number of clients that needs attention, so use that information to limit the looping.

revert commit 346f28eeaa205d268d1e63c7ffd86cf041f6d1e6 keep mark_nonblock in utils.c, as otherwise the build for the regress suite will fail (mark_nonblock needs fatal which is in gmid.c, and we can't link gmid.o with the regress suite...)