Fix probe detaching and auto-kprobes

* for #605, this diff moves probe storage from the BPF module to the BPF object,
  letting each instantiation clean up its own probes. A module-level counter
  for all open probes is provided for the quota check. It also adds a
  `cleanup()` function to force cleanup before the `atexit` handler runs.

* for #614, it removes the `len(open_kprobes) == 0` check that prevented more
  than one autoload probe working. It fixes the tests that this change breaks by
  calling the `cleanup()` function added.

Prior to this diff we used inconsistent types for keys in `open_kprobes`. The
results from the regex match (`attach_kprobe(event_re=..)`) and the automatic
`kprobe__` features were passed through `str.decode()`, yielding unicode keys,
but specific matches (i.e. from `attach_kprobe(event=..)`) were stored with
string keys passed down from the caller. Only probes under string keys were
released in `cleanup_kprobes`, leaving attached probes on program exit.

This diff makes all the keys regular strings. I erred on the side of using
regular strings over `str.decode()`ing them because a) this data isn't passed
outside of Python, b) it's more Python 3 compatible (there is no `.decode()` on
a regular string object in Python 3 so such a change would ultimately need
removing again).

I also cleaned up a few other things:

* removed the call to `awk` for getting probable functions

* removed the `isinstance` checks when cleaning uprobes/tracepoints -- we
  should only have string keys in these dicts

* made `num_open_kprobes` skip the perf_events buffers. People likely use this
  to check that the right number of probes have been placed so counting
  perf_events buffers doesn't make sense here

killsnoop: s/failed opens/failed kill syscalls/

fileslower: try probing vfs_write if __vfs_write is missing

Build debian packages in docker containers

Full tracepoint support in Clang front-end

Older versions of GCC don't support std::regex even though they support
most of C++11. To avoid breaking the build on older systems, such as
Ubuntu 14.04, use manual parsing instead of std::regex.

When a probe function refers to a tracepoint arguments structure,
such as `struct tracepoint__irq__irq_handler_entry`, add that structure
on-the-fly using a Clang frontend action that runs before any other
steps take place.

Typically, the user will create tracepoint probe functions using
the TRACEPOINT_PROBE macro, which avoids the need for specifying
the tracepoint category and event twice in the signature of the
probe function.

When a function in the BPF program starts with "tracepoint__", parse
the rest of the name as a tracepoint category and name and attach the
tracepoint automatically. For example:

```
int tracepoint__sched__sched_switch(...)
```

As a result, the sched:sched_switch tracepoint is enabled and the function
is attached to that tracepoint.

On some systems, was seeing a failure at tests/cc/test_c_api.cc:172 due
to failure to open the /tmp/perf-pid.map file. Looking through the code,
narrowed it down to an invalid use of c_str() on a temporary
std::string. Fix it by storing the string in a variable.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Upstream, params() was renamed to parameters(). In order to support both
old and new LLVM, use the unchanged param_begin and param_end API.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* libbcc: fix off-by-one errors in resolving adjacent modules/symbols, add test

* libbcc: use binary search in ProcSyms::Module::find_addr()

Add ctypes declarations for `bpf_attach_tracepoint` and
`bpf_detach_tracepoint` in libbcc.py. It works anyway, but now
it's a bit safer.

cpudist: Support off-cpu time reports

bcc: Tracepoint support in libbpf and BPF

The test asserts that we can enable the sched_switch tracepoint and read
some events from it. The test is also marked to require kernel 4.7 or
later, because that's where the BPF support for tracepoints was introduced.

It seems from experimentation that the calculated timestamps between
on- and off-CPU switch events can produce incorrect results, with a
later event having a smaller timestamp. Discard events when the
resulting delta time would be negative.

The `sched_switch` tracepoint approach requires storing the previous
task's tgid in a map and fetching it from there, because it is not
available as a tracepoint argument. Instead, placing a kprobe on the
`finish_task_switch` function allows cleanly fetching the previous
task's pid and tgid from the task_struct.

When the `-O` switch was provided, cpudist was unnecessarily filtering
out scheduling events arising from a task waking up when the previous
task was not running. On an idle system, this happens a lot, and causes
events to be missed. This is now fixed.

Use `/proc/$PID/comm`, which may fail, for example if the original
process already exited. This may also produce misleading results
if another process got the same pid, but there's no way around this.

Add -O switch, which directs cpudist to collect off-CPU time
statistics. Also restructure the code slightly and added examples
as appropriate.

Introduce tracepoint support in libbpf via new `bpf_attach_tracepoint`
API, which takes the tracepoint category and name (e.g. "sched",
"sched_switch"). Attach the tracing program to the tracepoint's id
and proceed as usual.

Add `attach_tracepoint` API to Python BPF module, which takes the
tracepoint description as a single string (e.g. "sched:sched_switch").
Load the BPF program with bpf_prog_type set to TRACEPOINT and then
call `bpf_attach_tracepoint` to attach it.

Due to an incorrectly referenced global variable, specifying a pid
to filter with a kernel probe produced an error. This is now fixed,
for example:

```
TIME     PID    COMM         FUNC
23:46:00 29967  bash         sched_switch
23:46:01 29967  bash         sched_switch
23:46:01 29967  bash         sched_switch
^C
```

* cpudist: summarize on-CPU time per task as a histogram

This is the initial implementation of the tool itself, which uses
the sched:sched_switch tracepoint to probe task switches. This is
a slightly more robust approach than using a kernel function, such
as finish_task_switch.

When native BCC support for tracepoints is introduced, this tool
can be reimplemented and reliance on the current Tracepoint module
can be removed.

* cpudist: add man page and examples

tools: fix getting {ext4,btrfs}_file_operations address (ref #583)

ext4slower: fix getting kallsyms address

$ grep ext4_file_operations /proc/kallsyms
ffffffffc0331340 r ext4_file_operations	[ext4]

* tcpretrans: support full IPv6 addresses, fix --lossprobe

* tcpaccept: support full IPv6 addresses, fix timestamps

* tcpconnect: support full IPv6 addresses, fix timestamps

* tcpconnlat: support full IPv6 addresses, fix timestamps