Allocations in critical section (was Re: WAL format and API changes (9.5))

Ok, I fixed the issues that the assertion fixed. I also committed a 
patch to add the assertion itself; let's see if the buildfarm finds more 
cases that violate the rule.

It ignores the checkpointer, because it's known to violate the rule, and 
allocations in ErrorContext, which is used during error recovery, e.g if 
you indeed PANIC while in a critical section for some other reason.

I didn't backpatch this. Although you shouldn't be running with 
assertions enabled in production, it nevertheless seems too risky. There 
might be some obscure cases where there is no real risk, e.g because the 
current memory context always has enough free space because of a 
previous pfree, and it doesn't seem worth tracking down and fixing such 
issues in backbranches. You have to be pretty unlucky to run out of 
memory in a critical section to begin with.

- Heikki