There was a typo in NGX_EACCES.

Reported by Goetz T. Fischer.

The mtx->wait counter was not decremented if we were able to obtain the lock
right after incrementing it.  This resulted in unneeded sem_post() calls,
eventually leading to EOVERFLOW errors being logged, "sem_post() failed
while wake shmtx (75: Value too large for defined data type)".

To close the race, mtx->wait is now decremented if we obtain the lock right
after incrementing it in ngx_shmtx_lock().  The result can become -1 if a
concurrent ngx_shmtx_unlock() decrements mtx->wait before the added code does.
However, that only leads to one extra iteration in the next call of
ngx_shmtx_lock().

The use_temp_path http cache feature is now implemented using a separate temp
hierarchy in cache directory.  Prefix-based temp files are no longer needed.

If pre_tree_handler() returns NGX_DECLINED, the directory is ignored.

The ctx->aio flag must be taken into account in the short path too.

Thanks to Joe Bialek, Adam Zabrocki and Microsoft Vulnerability Research.

Now, if the "path" parameter is NULL, ngx_create_temp_file() will use
file->name as a predefined file path prefix.

The original check for NGX_AGAIN was surplus, since the function returns
only NGX_OK or NGX_ERROR.  Now it looks similar to other places.

No functional changes.