include cleanup

The Zeek code base has very inconsistent #includes.  Many sources
included a few headers, and those headers included other headers, and
in the end, nearly everything is included everywhere, so missing
#includes were never noticed.  Another side effect was a lot of header
bloat which slows down the build.

First step to fix it: in each source file, its own header should be
included first to verify that each header's includes are correct, and
none is missing.

After adding the missing #includes, I replaced lots of #includes
inside headers with class forward declarations.  In most headers,
object pointers are never referenced, so declaring the function
prototypes with forward-declared classes is just fine.

This patch speeds up the build by 19%, because each compilation unit
gets smaller.  Here are the "time" numbers for a fresh build (with a
warm page cache but without ccache):

Before this patch:

 3144.94user 161.63system 3:02.87elapsed 1808%CPU (0avgtext+0avgdata 2168608maxresident)k
 760inputs+12008400outputs (1511major+57747204minor)pagefaults 0swaps

After this patch:

 2565.17user 141.83system 2:25.46elapsed 1860%CPU (0avgtext+0avgdata 1489076maxresident)k
 72576inputs+9130920outputs (1667major+49400430minor)pagefaults 0swaps

src/logging/Manager.cc

@@ -1,6 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <algorithm>
+#include "Manager.h"
+
+#include <utility>
 
 #include "Event.h"
 #include "EventHandler.h"
@@ -8,18 +10,21 @@
 #include "Net.h"
 #include "Type.h"
 #include "File.h"
+#include "input.h"
 
 #include "broker/Manager.h"
 #include "threading/Manager.h"
 #include "threading/SerialTypes.h"
 
-#include "Manager.h"
+#include "Desc.h"
 #include "WriterFrontend.h"
 #include "WriterBackend.h"
 #include "logging.bif.h"
 #include "plugin/Plugin.h"
 #include "plugin/Manager.h"
 
+#include <broker/endpoint_info.hh>
+
 using namespace logging;
 
 struct Manager::Filter {

src/logging/Manager.h

@@ -4,8 +4,6 @@
 
 #pragma once
 
-#include <broker/endpoint_info.hh>
-
 #include "../Val.h"
 #include "../Tag.h"
 #include "../EventHandler.h"
@@ -14,6 +12,7 @@
 #include "Component.h"
 #include "WriterBackend.h"
 
+namespace broker { struct endpoint_info; }
 class SerializationFormat;
 class RotationTimer;
 

src/logging/Tag.h

@@ -3,13 +3,17 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "util.h"
 #include "../Tag.h"
-#include "plugin/TaggedComponent.h"
-#include "plugin/ComponentManager.h"
 
 class EnumVal;
 
+namespace plugin {
+template <class T>
+class TaggedComponent;
+template <class T, class C>
+class ComponentManager;
+}
+
 namespace logging {
 
 class Manager;

src/logging/WriterFrontend.h

@@ -4,8 +4,6 @@
 
 #include "WriterBackend.h"
 
-#include "threading/MsgThread.h"
-
 namespace logging  {
 
 class Manager;

src/logging/writers/ascii/Ascii.h

@@ -7,6 +7,7 @@
 #include "logging/WriterBackend.h"
 #include "threading/formatters/Ascii.h"
 #include "threading/formatters/JSON.h"
+#include "Desc.h"
 #include "zlib.h"
 
 namespace logging { namespace writer {

src/logging/writers/none/None.cc

@@ -4,6 +4,8 @@
 #include "None.h"
 #include "none.bif.h"
 
+#include <iostream>
+
 using namespace logging;
 using namespace writer;
 

src/logging/writers/sqlite/SQLite.h

@@ -9,6 +9,7 @@
 #include "logging/WriterBackend.h"
 #include "threading/formatters/Ascii.h"
 #include "3rdparty/sqlite3.h"
+#include "Desc.h"
 
 namespace logging { namespace writer {