Fix regression by restarting on artifact download errors

* reformat lxc guide

* reformat lxc guide

docs: clarify use of toJSON for passwords

Run Docker tests in Windows AppVeyor CI

Fixes #5347

docker: Avoid leaking containers during Reattach

tests: port TestAllocRunner_Destroy from 0.8

Also add destroy(ar) helper to fix a bunch of shutdown races in AR
tests.

Currently if a docker_logger cannot be reattached to, we will leak the
container that was being used. This is problematic if e.g using static
ports as it means you can never recover your task, or if a service is
expensive to run and will then be running without supervision.

Track the download status of each artifact independently so that if only
one of many artifacts fails to download, completed artifacts aren't
downloaded again.

Increase resiliency of docker driver logging

Co-Authored-By: dantoml <dani@tomlinson.io>

Sometimes the nomad docker_logger may be killed by a service manager
when restarting the client for upgrades or reliability reasons.

Currently if this happens, we leak the users container and try to
reschedule over it.

This commit adds a new step to the recovery process that will spawn a
new docker logger process that will fetch logs from _the current
timestamp_. This is to avoid restarting users tasks because our logging
sidecar has failed.

0.9.0beta2 contains a regression where artifact download errors would
not cause a task restart and instead immediately fail the task.

This restores the pre-0.9 behavior of retrying all artifact errors and
adds missing tests.

Adds a new helper and removes a duplicated test.

Fix colored terminal output on Windows

Replace IsTravis() references that is intended for more CI environments
rather than for Travis environment specifically.

This commit uses the go-colorable library to enable support for coloured
UI output on Windows. This acts as a compatibility layer that takes
standard unix-y terminal codes and translates them into the requisite
windows calls as required.

Skip currently Docker tests that fail on Windows for further
investigation.

Prepare to run docker on AppVeyor Windows environment

drivers: restore port_map old json support

storage_opts is a new field in 0.9 cycle and doesn't have backward
compatibility constraints.

* CVE-2019-5736: Update libcontainer depedencies

Libcontainer is vulnerable to a runc container breakout, that was
reported as CVE-2019-5736[1].  Upgrading vendored libcontainer with the fix.

The runc changes are captured in https://github.com/hashicorp/runc/commits/369b920277d27630441336775cd728bc0f19e496 .

[1] https://seclists.org/oss-sec/2019/q1/119

client: fix setting alloc unhealthy at deadline

During the 0.9 client refactor the code to fail a deployment when the
deadline was reached was broken. This restores and tests that behavior.

This commit adds some extra resiliency to the docker logger in the case
of API failure from the docker daemon, by restarting the stream from the
current point in time if the stream returns and the container is still
running.

Fix https://github.com/hashicorp/nomad/issues/5315

This ensures that `port_map` along with other block like attribute
declarations (e.g. ulimit, labels, etc) can handle various hcl and json
syntax that was supported in 0.8.

In 0.8.7, the following declarations are effectively equivalent:

```
// hcl block
port_map {
  http = 80
  https = 443
}

// hcl assignment
port_map = {
  http  = 80
  https = 443
}

// json single element array of map (default in API response)
{"port_map": [{"http": 80, "https": 443}]}

// json array of individual maps (supported accidentally iiuc)
{"port_map: [{"http": 80}, {"https": 443}]}
```

We achieve compatbility by using `NewAttr("...", "list(map(string))",
false)` to be serialized to a `map[string]string` wrapper, instead of using
`BlockAttrs` declaration.  The wrapper merges the list of maps
automatically, to ease driver development.

This approach is closer to how v0.8.7 implemented the fields [1][2], and
despite its verbosity, seems to perserve 0.8.7 behavior in hcl2.

This is only required for built-in types that have backward
compatibility constraints.  External drivers should use `BlockAttrs`
instead, as they see fit.

[1] https://github.com/hashicorp/nomad/blob/v0.8.7/client/driver/docker.go#L216
[2] https://github.com/hashicorp/nomad/blob/v0.8.7/client/driver/docker.go#L698-L700

expand job init example with spread and affinity

minor

Fix Consul Service PreKill Hook

api: Fix compatibility with pre 0.9 API jobs