WIP patch for tuple freezing issues

Attached is a draft patch for the WAL-and-freezing issues we've been
discussing.  This incorporates Heikki and Simon's work on providing
WAL-logging for tuple freezing actions and pg_clog truncation
respectively, and adds on several other things:

* replace logic for when to truncate pg_clog, as discussed: it's now
driven off the system-wide minimum relfrozenxid.

* add GUC variables and pg_autovacuum support to control the freeze
distance (how far back a VACUUM sets its freeze cutoff, which becomes
the table's new relfrozenxid) as well as the freeze limit (the age of
relfrozenxid at which we force an autovacuum cycle).

* revise the autovacuum logic to exploit the per-table tracking of
relfrozenxid better: there is no concept of a "database wide autovacuum"
anymore, rather we make table-by-table decisions about what needs to
be vacuumed.

* revise the mechanism for forcing autovacs when the freeze limit is
exceeded --- this was previously checked only on completion of a VACUUM,
which seems a bit untrustworthy (if you're not vacuuming, it won't
help).  I moved the functionality to varsup.c instead, where we already
had the forced-shutdown-before-wraparound code.

The patch is not ready to apply because it needs more testing (anyone
want to help?) and because I need to do more documentation work;
maintenance.sgml and the vacuum ref page both need some TLC.

Comments?

            regards, tom lane