testing strategy:
 - use an external method with a transaction manager which sleeps
  for 20 seconds during tpc_vote and tpc_commit
 - commit such a transaction
 - stop zope
 - check the stop happens after the tpc_commit

https://mariadb.com/kb/en/enabling-core-dumps/

For now this still have to be enabled with a config like this in a .conf
file in srv/telegraf/extra-config/  :

    [[inputs.execd]]
      name_override = "slapos"
      # this needs sudo when using can not access supervisor socket, like when being installed in root slapos
      command = ["/usr/bin/sudo", "$SOFTWARE_DIR/go.work/bin/telegraf-input-slapos", "-config", "/path/to/slapos.conf"]

/path/to/slapos.conf would contain something like this:

    [[inputs.slapos]]
      ## Folder where partitions are located
      instance_root = "/srv/slapgrid/"

      ## filepath.Glob pattern to look for recursive instances
      recursive_instance_glob_pattern = "*/srv/runner/inst*/"

      ## Path of supervisor socket, relative to instance root
      socket_name = "sv.sock"

This version has a new sql input, that can be used to get metrics from sql
queries.

This reverts commit 31eaaec1.

This slows down business template by a factor of two and it seems we
don't need it. I'm experimenting with hacks in ppml.py but maybe just
creating the Unpickler with encoding='utf-8' in
product/ERP5Type/XMLExportImport/__init__.py:267 is enough ?

at this point they all fail after long timeouts, because neo does not
support py3 yet

Not sure why it was OK on python2 and not sure if this has to be done
or the promise code needs to cast the results of getConfig()

Otherwise it fails with the following exception because of non-ASCII characters
(`[A-Z&é@{]{3,7})`) (see unconvert()) below):

  => erp5_core/PathTemplateItem/portal_preferences/default_site_preference.xml
     File "zodbpickle-2.0.0-py3.7-linux-x86_64.egg/zodbpickle/pickle_3.py", line 844, in load
        dispatch[key[0]](self)
     File "zodbpickle-2.0.0-py3.7-linux-x86_64.egg/zodbpickle/pickle_3.py", line 1035, in load_short_binstring
        self.append(self.decode_string(data))
     File "zodbpickle-2.0.0-py3.7-linux-x86_64.egg/zodbpickle/pickle_3.py", line 989, in decode_string
        return value.decode(self.encoding, self.errors)
  UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 19: ordinal not in range(128)

This reverts commit 6c399134.

The strategy for compatibility is that:
 - haproxy still listen on the same port as before, without rewrite rule.
   This is called "legacy" port.
 - for each frontend from request parameters, we introduce an haproxy
   frontend with a rewrite for the corresponding `internal-path`
   parameter.
 - the shared frontend instance is updated to use this new frontend
   entry from haproxy. This will cause a small downtime until the shared
   frontend is updated to the new URL on ERP5, but since this feature
   was not used, it's OK.

Technical details are that we:
 - split haproxy config to have frontends and backends.
 - introduce one frontend in haproxy for each frontend from request
   parameters.
 - routing-rule-list argument is still honored the same way, globally
   and after path from frontend.
 - change the shared frontend requests to use "" type, no longer "zope"
   type.
 - we don't do automatic detection of /VirtualHostRoot in URL but always
   add it, because it could be used to trick zope into thinking it
   serves requests for an arbitrary host and do open redirects
 - before using the request's host header in virtualhost path, we check
   that it does not contain /, to prevent injection of virutalhost path
   elements through the host header.
 - we don't use the "path" parameter from shared frontend, because we
   want the frontend to be simple, so we don't want it to rewrite the
   request path (which is also the reason why we deprecated "zope" type)
 - the tests have changed a lot, because they were using what's now the
   "legacy" URL types, so we updated it to use the new URL types with
   all the /VirtualHostRoot/../ in path and also because they use IPv6
   URL, no longer IPv4

and save the already allocated ports in a state file, so that requesting
new families does not change already allocated ports.

This reverts commit 620c9332 (stack/erp5: stop using caucase managed
certificate for balancer, 2020-11-10) with an updated design. We add a
caucase service for balancer in the balancer partition. The caucase
service from the root partition (that was not used) is removed.

The underlying idea is that the default configuration should use multiple
caucases with limited scope, here we have one caucase to manage the
certificate used by haproxy server in the balancer partition, so we put
one caucase to manage this certificate and the caucase is configured to
auto-accept one certificate only. The plan is that when we will add a
certificate for mariadb server, we'll add another caucase inside this
mariadb server.

For more advanced usage and also to support the cases where a new
certificate needs to be re-emitted for some reason, users can request
with an existing caucase URL. In that case, they will have to accept
the certificate requests.

Notable changes:

balancer/ssl/caucase-url is no longer documented in parameters, this is
an internal parameter, users can pass one global caucase service to
manage all partition

CAUCASE environment variable is no longer set when running zope. There
was no identified use case and with this new approach of multiple
caucases, the term "caucase" alone became ambiguous.

This is not documented in schema and has no effect in erp5 (but this is
still used for slapos-master)

This change the format or the (mostly) unused frontend parameter to
support requesting more than one frontend and also enable the request of
a frontend by default, so that requesting a frontend separately is no
longer needed.

The `frontend` parameter now also supports requesting frontends for
specific paths on the ERP5 backend, the example below requests a
frontend serving directly a web site, with the necessary rewrite rules:

```js
{
  "frontend": {
    "default": {
      "internal-path": "/erp5/web_site_module/renderjs_runner/"
    }
  }
}
```

The example below requests a default frontend to the erp5 root, to
access the ZMI or erp5_xhtml_style interface and two web sites:

```js
{
  "frontend": {
    "default": {},
    "erp5js": {
      "internal-path": "/erp5/web_site_module/renderjs_runner/"
    },
    "crm": {
      "internal-path": "/erp5/web_site_module/erp5_officejs_support_request_ui/"
    }
  }
}
```

The example below has an explicit definition of the zope families using
`zope-partition-dict` parameter, because there is more than one zope
family, no frontend is requested by default:

```js
{
  "zope-partition-dict": {
    "backoffice": {
      "family": "backoffice"
    },
    "web": {
      "family": "web"
    },
    "activities": {
      "family": "activities"
    }
  }
}
```

Continuing this example, to have frontends for backoffice and web
families, the frontend request can specify the families, like it is
demonstrated in the example below. In this example, we don't specify an
entry for "activities" family, so no frontend will be requested for
this family.

```js
{
  "frontend": {
    "backoffice": {
      "zope-family": "backoffice"
    },
    "web": {
      "zope-family": "web",
      "internal-path": "/erp5/web_site_module/web_site/"
    }
  }
  "zope-partition-dict": {
    "backoffice": {
      "family": "backoffice"
    },
    "web": {
      "family": "web"
    },
    "activities": {
      "family": "activities"
    }
  }
}
```

This makes urljoin works as expected and generally makes sense because
this is a collection.

See merge request nexedi/slapos!1500

Directly expose all passlib.hash supported hashes, using a `passwd-`
prefix. For example, to access `sha256_crypt`, use `passwd-sha256-crypt`
option name.

  [secret]
  recipe = slapos.cookbook:generate.password

  [config-file]
  hashed-password = ${secret:passwd-sha256-crypt}

This changes the format of storage-path, it used to be the password in
plain text, it is now a mapping also containing hashed passwords, to
have the same hashed passwords for each buildout run.

This needs collaboration from publish_early recipe, because .pop(k) does
raised a KeyError with the dict.__missing__  approach.

In MultiRU there will be only one ENB which supports all TDD, FDD, LTE and NR
cells and different types of radio units - all at the same time. This patch is
preparatory step for that: it merges gnb configuration template into enb
configuration template, so that enb.jinja2.cfg now serves both enb and gnb
instances.

In this patch for now we only move code from gnb.jinja2.cfg without changing
it(*) and wrap parts with `if do_lte` and `if do_nr` correspondingly.

The end result of rendered enb.cfg and gnb.cfg stays the same modulo space
changes and added innoccent `#define TDD` as Appendix shows.

(*) the only exception is set up of gtp_addr which has practically the same
code, was wrapped with `if mme_list` in enb and `if amf_list` in gnb, and is now
wrapped with `if mme_list or amf_list`.

/cc @lu.xu, @tomo, @xavier_thompson, @Daetalus
/reviewed-by @jhuge
/reviewed-on nexedi/slapos!1512

--------

Appendix. Diff for rendered enb.cfg and gnb.cfg before and after this patch.

```
$ ./pythonwitheggs slapos-render-config.py && (git diff -w --no-index config/enb.cfg.old config/enb.cfg ; git diff -w --no-index config/gnb.cfg.old config/gnb.cfg)
```

```diff
diff --git a/config/enb.cfg.old b/config/enb.cfg
index fdf3ab24d..cb46697ea 100644
--- a/config/enb.cfg.old
+++ b/config/enb.cfg
@@ -1,11 +1,15 @@

+
 #define TDD                 1

 #define N_RB_DL             50
+
 #define N_ANTENNA_DL        2
+
 #define N_ANTENNA_UL        2

+
 {

   log_options: "all.level=error,all.max_size=0,nas.level=debug,nas.max_size=1,s1ap.level=debug,s1ap.max_size=1,x2ap.level=debug,x2ap.max_size=1,rrc.level=debug,rrc.max_size=1,phy.level=info,file.rota>
@@ -24,7 +28,6 @@
   rx_gain: 43,

   com_addr: "127.0.1.2:9001",
-
   mme_list: [

     {
@@ -33,9 +36,9 @@

   ],

+
   gtp_addr: "127.0.1.1",

-
   enb_id: 0x1A2D0,

   cell_list: [{
@@ -49,7 +52,6 @@
       ],
     }
   ],
-
   cell_default: {
     plmn_list: [
       "00101",
@@ -226,4 +228,6 @@
   meas_gap_config: "gp0",
   ho_from_meas: true,
   },
+
+
 }
\ No newline at end of file
diff --git a/config/gnb.cfg.old b/config/gnb.cfg
index e3d671e09..4e47a2094 100644
--- a/config/gnb.cfg.old
+++ b/config/gnb.cfg
@@ -1,15 +1,21 @@

+
+#define TDD                 1
+
+
 #define N_ANTENNA_DL        2

 #define N_ANTENNA_UL        2

+
 {

   log_options: "all.level=error,all.max_size=0,nas.level=debug,nas.max_size=1,ngap.level=debug,ngap.max_size=1,xnap.level=debug,xnap.max_size=1,rrc.level=debug,rrc.max_size=1,phy.level=info,file.rota>

   log_filename: "log/gnb.log",

+
   rf_driver: {
       name: "sdr",
       args: "dev0=/dev/sdr0",
@@ -30,15 +36,17 @@
   ],

-
-
   gtp_addr: "127.0.1.1",

   gnb_id_bits: 28,
   gnb_id: 0x12345,
   en_dc_support: true,
-  cell_list: [],
+
+  cell_list: [
+  ],
+
+
   nr_cell_list: [
   {
     rf_port: 0,
```