Discussed with: @adschellevis

o Respect the 'dnslocalhost' option, which wasn't previously possible
  because dhcpleases clobbered /etc/hosts directly anyway.
o Align the code with how unbound does it: use a private file for
  the hosts generation.
o HUP dnsmasq at the end of the hosts file regeneration.
o `--dhcp-hostsfile' was really really wrong as /etc/hosts is read
  automatically, and the file specified here should have been adhering
  to the dhcp leases format of on `--dhcp-host' argument per line.

(proxy) add ftp support again for remote acl download. We switched to python's requests library, which doesn't support ftp. Some people still use ftp though.

Getting crowded...

(ipsec) fix syslog output, eventually we should switch to the new style loggers, but for now it's better to make sure charondebug is respected.

From the docs:

Starting with version 4.2.9, strongSwan provides a much more flexible configuration of the loggers. Logger configurations in strongswan.conf have a higher priority than charondebug in ipsec.conf: If you define any loggers in strongswan.conf, charondebug does not have any effect at all.

Turns out unbound reload flushes cache as well.  Also, unbound-control
may hang when it runs into an "undefined state" (stoping a stopped
service, right), and lastly it wants to chroot after being chrooted
on reload, something that cannot be fixed with using unbound-control.

Keep unbound-control-setup in case somebody finds the facility useful.

Firmware MVC pages were introduced in 2015, since having been worked
on by Deciso and myself.

IPFW and PF are used for more than just firewall and shaper, e.g.
NAT, policy routing or shaping, and the plugin framework supports
registering multiple user-facing services per file.

pkg can display to-be-deleted packages, but won't resolve these
issues when triggered using "upgrade -n".  Thus, it's pointless
to try to keep this code until a newer pkg release can actually
cope with resolving the full upgrade cycle before upgrading.