Add PFMoveApplication, which offers to move the app to /Applications or ~/Applications on first launch

Nil out the delegate of the profile name field in the edit current session prefs panel because it gets made first responder from a delayed perform after its delegate is released (the delayed perform is in openToProfileWithGuid:selectGeneralTab:). When the text field tries to become first responder it checks with its delegate, and that dies when zombies are enabled.

Cap the number of commands, hosts, and directories saved per session to 100 to keep the saved state from getting too big. Issue 5029

Decode images out of process. This is for improved security because buffer overflows when decoding images are a real risk. This commit adds a new executable, image_decoder, which reads a compressed image on fd 0 and writes JSON describing its frames, sizes, and delays (for animated GIFs) on fd 1. When an image is received, the image_decoder job is run in a sandbox. Likewise, when iTerm2 restores saved state, image_decoder again decodes each image. In this way images that were not in our control are always passed through image_decoder. Some images, like the broken pipe graphic, are under our control and do not need to be decoded out of process. When restoring state, one image at a time is decoded in order of most recently requested. This provides adequate performance while minimizing latency.

Remove preference to permanently silence multiline paste warning if the default action is cancel. Issue 5115.

Cap the number of commands, hosts, and directories saved per session to 100 to keep the saved state from getting too big. Issue 5029

Decode images out of process. This is for improved security because buffer overflows when decoding images are a real risk. This commit adds a new executable, image_decoder, which reads a compressed image on fd 0 and writes JSON describing its frames, sizes, and delays (for animated GIFs) on fd 1. When an image is received, the image_decoder job is run in a sandbox. Likewise, when iTerm2 restores saved state, image_decoder again decodes each image. In this way images that were not in our control are always passed through image_decoder. Some images, like the broken pipe graphic, are under our control and do not need to be decoded out of process. When restoring state, one image at a time is decoded in order of most recently requested. This provides adequate performance while minimizing latency.

Fix a bug where the color picker's eyedropper didn't work on any display other than screen 0. Issue 4821.

It didn't work well when another app became active (the popover overlapped it) or when a terminal window moved between the panel and the popover.

This reverts commit f783a5b7.

Fix incorrect tab filler orphan removal and tests that incorrectly assumed tab fillers followed a tab character. They precede it. Issue 5075

Remove table view delegate and data source in key mapping view controller to fix crash in issue 5080.

When exec fails show the command, why it failed, and if it failed because the file wasn't found, show the PATH that was searched