Add probabilistic "bup gc", but require --unsafe

Add probabilistic "bup gc", but require --unsafe

WARNING: This code is UNSAFE, please test it with care.  Among other
things, it adds the first bup command that intends to modify packfiles.
Also, the code assumes/requires a "quiet" repository; any simultaneous
access is dangerous.

Add a "bup gc" command that uses a Bloom filter to track the live
objects during the mark phase.  This means that the collection is
probabilistic -- that it may retain some (known) percentage of
garbage, but it can also work within a reasonable, fixed RAM budget
for any particular percentage and repository size.

In many cases, this may be sufficient and preferable, but in the
longer run, we might also want to add a precise method that guarantees
bup retains *no* unreachable/dead objects -- nothing here should
prevent that.

This command is potentially dangerous, so until we've had broader
testing, require all invocations to specify --unsafe, and make it clear
in the documentation that this command isn't considered stable.

Thanks to Tim Riemenschneider for suggesting the pruning of already
visited trees, and an earlier implementation thereof.  Thanks to Ben
Kelley for testing and reporting bugs in earlier versions of the
current implementation.

Thanks to Ben Kelly for help devising this Bloom-based approach, and for
testing and reporting bugs in earlier versions.

Signed-off-by: Rob Browning <rlb@defaultvalue.org>
Tested-by: Rob Browning <rlb@defaultvalue.org>