**Which issue(s) this PR fixes**: 
None.

**What this PR does / why we need it**: 
Add feature to evacuate chunk files when retry limit.
When reached the retry limit, `buf_file` and `buf_file_single` evacuates
all the chunk files (and the meta files) in the queue to the following
dir before purging.

* `(root_dir)/buffer/(plugin-id)/`

`root_dir` is `system_config.root_dir` if it is configured.
Otherwise, `DEFAULT_BACKUP_DIR` is applied.
(`/tmp/fluent`. We can change this by env var `FLUENT_BACKUP_DIR`)

There is no separate directory for each worker because the IDs of each
chunk are entirely unique.
This makes recovery easier.

After the problem with the flush (such as a network issue) is resolved,
we can put back the files and restart Fluentd to flush them again.

## Difference from the `backup` feature:

The `backup` feature is for unrecoverable errors, mainly for bad chunks.
On the other hand, this feature is for normal chunks.
The main motivation for this feature is to enable recovery by evacuating
buffer files
when the retry limit is reached due to external factors such as network
issues.

## Difference from the `secondary` feature:

The `secondary` feature is not suitable for recovery.
It can be difficult to recover files made by `out_secondary_file`
because the metadata is lost.
For file buffers, the easiest way for recovery is to evacuate the chunk
files as is.
Once the issue is recovered, we can put back the chunk files, and
restart Fluentd to load them.
This feature enables it.

**Docs Changes**:
fluent/fluentd-docs-gitbook#583

**Release Note**: 
Same as the title.

Signed-off-by: Daijiro Fukuda <fukuda@clear-code.com>