Do not call restartListening() on transition to firewalled

by checking if a peer qualifies when adding, rather than
iterating through the whole netdb to generate an exclusion list at the start.
This was very inefficient and generated needless lookup storms via lookupBeforeDropping()
Same idea for getClosetHopExclude()
Goal is to never iterate through all the known routers, profiles, or connected peers
to select peers for a single tunnel.
Add ExcluderBase and 4 classes for various cases:
Excluder, ClosestHopExcluder, IBGWExcluder, and OBEPExcluder.

Change CSFI.getEstablished() from a Set to a List for efficiency
Improve efficiency of selectActivePeersNotFailingPeers()
by iterating through connected list rather than profiles.
Do not add not-connected peers to exclude set,
which would become huge for hidden routers.

Change getExclude() to shouldExclude()
The exclude set calls shouldExclude() in contains().
Pass the exclude set to ProfileOrganizer.

For client tunnels, do OBEP and IBGW checks at peer selection time,
not afterwards in ConnectChecker, so it doesn't fail at the end in checkTunnel().

Check closest hop when hidden.
Fail-fast for inbound when no connected peers and hidden, do not fall back to non-connected peers.
Should improve startup time for hidden routers.

Use ArraySet for matches to save space
Remove unused selectPeersLocallyUnreachable() and selectPeersRecentlyRejecting()

No peer selection policy changes here.

Split sections into separate tabs
Clean up VersionAvailable.toString()
Don't limit height of DHT section

Fix JS search when refresh disabled
Fix search cancel when JS disabled

to save space, included ~50x
Disabled in 2012 for "HTML compliance" reasons

Minor cleanup in est. mgr

for efficiency where thread safety not required

Install fonts

See merge request !78

Publish based on max tunnels setting only, other limits todo.
Tested on a single router.
Publishing disabled until the next release.
No handling of the caps yet in peer selection or profiling, todo.

Reported by Qubes
ref: http://zzz.i2p/topics/3555

No UI, must edit config file and restart.
ref: http://zzz.i2p/topics/3549

Contains code adapted from I2P+. License:
Permission is granted to upstream to incorporate I2P+ modifications under the license
of the applicable upstream subsystem as specified in LICENSE.txt.

Broken in move from mtn to git
Fix some places that were broken even with mtn

Do not rebind internal port if only SSU external port changed
so "full cone" NAT will work
Log warning if NTCP configured with fixed port different from SSU

Eliminate Symmetric NAT errors for "full cone" NATs with different external port
Separate isPortFixed() states for IPv4 and IPv6
Allow port changes when state is unknown
Require two tests to transition from unknown IPv4 state
Save external port config on change
Don't reset external port config at startup
Add port change event to event log

Fix rare peer test NPE if we did not set charlie's hash

Remove ERR- and WARN- prefixes from translated status strings