Switch back to QueuedThreadPool (ticket #1395)
In Jetty 5/6, the default QTP was not concurrent, so we switched to
ThreadPoolExecutor with a fixed-size queue, a set maxThreads,
and a RejectedExecutionPolicy of CallerRuns.
Unfortunately, CallerRuns causes lockups in Jetty NIO.
In addition, no flavor of TPE gives us what QTP does:
- TPE direct handoff (which we were using) never queues.
  This doesn't provide any burst management when maxThreads is reached.
  CallerRuns was an attempt to work around that.
- TPE unbounded queue does not adjust the number of threads.
  This doesn't provide automatic resource management.
- TPE bounded queue does not add threads until the queue is full.
  This doesn't provide good responsiveness to even small bursts.
QTP adds threads as soon as the queue is non-empty.
QTP as of Jetty 7 uses concurrent.
QTP unbounded queue is the default in Jetty.
So switch back to QTP with a bounded queue, which does what we want,
which is first expand the thread pool, then start queueing, then reject.

ref:
http://docs.oracle.com/javase/6/docs/api/java/util/concurrent/ThreadPoolExecutor.html
https://wiki.eclipse.org/Jetty/Howto/High_Load

  - Move from core to RouterKeyGenerator in router.jar
  - Leave RoutingKeyGenerator as a simple abstract class
  - DatabaseEntry now uses timestamp instead of mod data
    to determine if mod data has changed. Don't expose
    mod data to DatabaseEntry any more.
  - I2PAppContext.routingKeyGenerator() now returns null;
    you must be in RouterContext to get a generator.

 * Router: Log warnings for unavailable crypto at startup

 - Re-enable plugin installation by default
 - Don't show configuration section or update-all button if no plugins installed

 - New router.sigType config
 - Generate / regenerate router keys based on config
 - New router.keys2 file format for sig types and padding
 - Fix RouterInfo.readBytes() signature verification with sig types
 - Catch unset padding in KeysAndCert.writeBytes()
 - Catch key errors in ReadRouterJob
 - Show RI sig type on /netdb in console
 - Move some things from Router to startup classes
 - Startup classes package private
 - Buffer readin of key files
 - Remove configurability of router.info and router.keys file locations

This will break Android and the i2pcontrol plugin but shouldn't affect anything else.

* Console, EventLog: Added {BECAME,NOT}_FLOODFILL events. They will now be shown on the console's /events page when the router's ff status changes.
* EventLog: Fix a minor typo.

don't require DSA key in SU3

 * i2ptunnel: More escaping

   - Fix update buttons
   - Don't filter parameter names starting with "nofilter_"
   - Re-allow configadvanced, news URL, and unsigned update URL if routerconsole.advanced=true
   - Re-allow plugin install if routerconsole.advanced=true or routerconsole.enablePluginInstall=true
   - Only allow whitelisted plugin signers, unless routerconsole.allowUntrustedPlugins=true
   - Re-allow clients.config changes if routerconsole.advanced=true or routerconsole.enableClientChange=true
   - More escaping
 * i2psnark: Fix add torrent form

Compiled by kytv from plugins.i2p
todo: implementation

another escape html

Disable clients.config editing in UI
Strip single quotes too
Fix double-escaping in susimail folder page

  - Fix several XSS issues (thx Aaron Portnoy of Exodus Intel)
  - Add Content-Security-Policy and X-XSS-Protection headers
  - Disable changing news feed URL from UI
  - Disable plugin install from UI
  - Disable setting unsigned update URL from UI
  - Disable /configadvanced
* DataHelper: Disallow \r in storeProps() (thx joernchen of Phenoelit)
* ExecNamingService: Disable (thx joernchen of Phenoelit)
* Startup: Add susimail.config to migrated files

At this point it's been offline for a month with no sign of returning.

 - Serializable
 - hashCode()
 - Make DataStructureImpl Serializable (removed from DataStructure in 2005)

   The last-modified date was getting updated even when
   the server returned e.g. 503, preventing routers from
   getting the latest file on a subsequent fetch.

As reported at http://zzz.i2p/topics/1630
untested

sk, ja, de, fr, it zh, nl, uk, nb