[boyter]

hashdeep audit fixes

Reproduced the failures reported in #12, which had four causes:

• md5 only files reported every file as modified. Files generated with -c md5 (e.g. by 1.4.0) have no sha256 column, and the empty value was
  compared against the calculated sha256. Only hashes present in the audit file are now calculated and compared, along with size.
• Absolute paths matched nothing. Relative paths are now resolved against the ## Invoked from: directory as well as the current directory, and
  ./file and file are treated as the same.
• Filenames with , or " broke parsing. Lines are split by column position as hashdeep does not quote filenames, rather than parsed as CSV.
• The audit file itself was counted as a new file when inside the audited directory. It is now skipped, as is the output file and SQLite sidecar
  files.

Also:

• Moved files now fail the audit, matching hashdeep.
• Results are reported in audit file order, then new files sorted.
• Identical files moved at the same time are each matched to their own record.
• A leading ./ the user supplied is kept in output paths, as hashdeep and md5sum do, so hashdeep -a can verify hashit -f hashdeep . output.

sum format

• Can be used as an audit file: GNU md5sum/sha256sum style (text and binary mode, escaped names), BSD --tag style, and hashit's own multi hash
  sum output. The hash is determined by file extension, then by length.
• Output escapes filenames containing \ or newlines the same way md5sum does, so md5sum -c can verify it.
• --mtime lines are written as # mtime ... comments which md5sum -c ignores.

SQLite audit

Merges sqliteaudit and finishes it:

• The audit database is opened read-only and never modified. Generated databases are left out of WAL mode so auditing creates no -wal/-shm files.
• Seen files are tracked in an on disk temporary table and the report streams over the database, so memory stays flat. 100k files used 32 MB vs 225 MB
  for a hashdeep file audit.
• The invoked from directory is stored in a new metadata table so relative databases can be audited using absolute paths or from another directory.
  Older databases without it still work.
• The hashes requested with --hash (or the defaults) are calculated and compared where the database also has them, with a warning when there are
  none in common.
• Moves are detected using the strongest common hash.
• Output is labelled hashit: SQLite Audit passed/failed.
• Restores the hashdeep cross verification tests the branch had removed from test-all.sh.

Other fixes

• An mtime read error stopped the worker processing any further files and leaked the open file handle. The file is now still hashed with mtime unset.
• Errors writing the output file are now reported rather than ignored.

Behaviour changes for release notes

• Moved files fail an audit (matches hashdeep).
• A leading ./ supplied on the command line is kept in output, e.g. hashit . prints ./file. Running with no arguments is unchanged.
• --mtime in sum format is written as # mtime <time> <file> comment lines.
• --output no longer replaces an existing file unless --overwrite is passed. For SQLite this replaces the database rather than merging into it,
  and is refused if the existing file is not a SQLite database.
• A failed audit exits non zero when using --output.

Testing

• New unit tests in processor/audit_parser_test.go and processor/audit_test.go.
• test-all.sh has new tests covering the Add Audit Mode #12 scenarios: audit file inside the directory, absolute vs relative paths, md5 only hashdeep files,
  hashdeep verifying hashit output from . and ./sub, md5sum/sha256sum/BSD tag files, md5sum -c verifying sum output with and without --mtime,
  SQLite path resolution, no files left behind, moves, and overwrite protection.
• test-all.sh passes in full.