We need to synchronize between various tx download structures.
TxRequest does not inherently need cs_main for synchronization, and it's
not appropriate to lock all of the tx download logic under cs_main.

This is a synchronous callback notifying clients of all tip changes.

It allows clients to respond to a new block immediately after it is
connected. The synchronicity is important for things like
m_recent_rejects, in which a transaction's validity can change (rejected
vs accepted) when this event is processed. For example, the transaction
might have a timelock condition that has just been met. This is distinct
from something like m_recent_confirmed_transactions, in which the
validation outcome is the same (valid vs already-have), so it does not
need to be reset immediately.

Resetting m_recent_rejects once per block is more efficient than
comparing hashRecentRejectsChainTip with the chain tip every time we
call AlreadyHaveTx. We keep hashRecentRejectsChainTip for now to assert
that updates happen correctly; it is removed in the next commit.

This also means AlreadyHaveTx no longer needs cs_main held.

The TxOrphanage is now guarded externally by m_tx_download_mutex.

If the binaries don't exist, the Guix build has failed for some other
reason.

There's no need to check for unknown architectures, or executable
formats, as the only ones that could be built are those that we've
configured toolchains for in Guix.

We've also been doing this inconsistently across the two scripts.

…jection filters once per tip change

c85acce [refactor] delete EraseTxNoLock, just use EraseTx (glozow)
6ff8406 remove obsoleted TxOrphanage::m_mutex (glozow)
61745c7 lock m_recent_confirmed_transactions using m_tx_download_mutex (glozow)
723ea0f remove obsoleted hashRecentRejectsChainTip (glozow)
18a4355 update recent_rejects filters on ActiveTipChange (glozow)
36f170d add ValidationInterface::ActiveTipChange (glozow)
3eb1307 guard TxRequest and rejection caches with new mutex (glozow)

Pull request description:

  See bitcoin#27463 for full project tracking.

  This contains the first few commits of bitcoin#30110, which require some thinking about thread safety in review.
  - Introduce a new `m_tx_download_mutex` which guards the transaction download data structures including `m_txrequest`, the rolling bloom filters, and `m_orphanage`. Later this should become the mutex guarding `TxDownloadManager`.
    - `m_txrequest` doesn't need to be guarded using `cs_main` anymore
    - `m_recent_confirmed_transactions` doesn't need its own lock anymore
    - `m_orphanage` doesn't need its own lock anymore
  - Adds a new `ValidationInterface` event, `ActiveTipChanged`, which is a synchronous callback whenever the tip of the active chainstate changes.
  - Flush `m_recent_rejects` and `m_recent_rejects_reconsiderable` on `ActiveTipChanged` just once instead of checking the tip every time `AlreadyHaveTx` is called. This should speed up calls to that function (no longer comparing a block hash each time) and removes the need to lock `cs_main` every time it is called.

  Motivation:
  - These data structures need synchronization. While we are holding `m_tx_download_mutex`, these should hold:
    - a tx hash in `m_txrequest` is not also in `m_orphanage`
    - a tx hash in `m_txrequest` is not also in `m_recent_rejects` or `m_recent_confirmed_transactions`
    - In the future, orphan resolution tracking should also be synchronized. If a tx has an entry in the orphan resolution tracker, it is also in `m_orphanage`, and not in `m_txrequest`, etc.
  - Currently, `cs_main` is used to e.g. sync accesses to `m_txrequest`. We should not broaden the scope of things it locks.
  - Currently, we need to know the current chainstate every time we call `AlreadyHaveTx` so we can decide whether we should update it. Every call compares the current tip hash with `hashRecentRejectsChainTip`. It is more efficient to have a validation interface callback that updates the rejection filters whenever the chain tip changes.

ACKs for top commit:
  instagibbs:
    reACK c85acce
  dergoegge:
    Code review ACK c85acce
  theStack:
    Light code-review ACK c85acce
  hebasto:
    ACK c85acce, I have reviewed the code and it looks OK.

Tree-SHA512: c3bd524b5de1cafc9a10770dadb484cc479d6d4c687d80dd0f176d339fd95f73b85cb44cb3b6b464d38a52e20feda00aa2a1da5a73339e31831687e4bd0aa0c5

1bc9f64 contrib: assume binary existence in sec/sym checks (fanquake)
51d8f43 contrib: simplify ELF test-security-check (fanquake)
1810e20 contrib: simplify PE test-security-check (fanquake)
6c9746f contrib: simplify MACHO test-security-check (fanquake)

Pull request description:

  The current `test-security-check` script is hard to understand, and change (i.e https://github.com/bitcoin/bitcoin/pull/29987/files#diff-52aa0cda44721f089e53b128cb1232a876006ef257b211655456b17dfb2ec712); tests are also not done in isolation (when-possible). Fix that, and add missing checks. Simplifies future toolchain/security/hardening changes.

ACKs for top commit:
  hebasto:
    ACK 1bc9f64 (assuming my Guix hashes match; I'll provide them shortly).
  TheCharlatan:
    ACK 1bc9f64

Tree-SHA512: 1885d0ce63a94ffa61345327f919da20b63de6dd4148d6db3ee8bad4485253a36e8ab0dbee48cecc02ea35d139edfed75453af45fc364bcbef6fe16b6823bc7a

Also add a sanity check for non-encapsulated (directory-wide) build
properties.

Co-authored-by: Cory Fields <cory-nospam-@coryfields.com>
Co-authored-by: Vasil Dimov <vd@FreeBSD.org>

Co-authored-by: Cory Fields <cory-nospam-@coryfields.com>

Co-authored-by: TheCharlatan <seb.kung@gmail.com>

If any of {C,CXX,CPP,LD}FLAGS is specified it should be assigned to
a non-type-specific variable.

This reverts commit 1155978.

Our `QT_STATICPLUGIN` macro is effectively equivalent to the Qt's
`QT_STATIC` macro. No need to handle both of them.

When using CMake, each plugin comes with a C++ stub file that
automatically initializes the static plugin. Consequently, any target
that links against a plugin has this C++ file added to its SOURCES,
which makes the removed code redundant.

To configure CMake for cross-compiling, use
`--toolchain depends/${HOST}/toolchain.cmake` command-line option.

The content of those variables is appended to the each target after the
flags added by the build system.

Keep this commit at the top when rebasing.

This change fixes CI jobs as the `miniupnpc` source archive is not
available neither at https://miniupnp.tuxfamily.org nor at
https://bitcoincore.org/depends-sources at this moment.