Communication between repman and mariadb can now use ssl for secure
connection.
Proxysql is also configured to work with ssl, user access database with
secure connection.

This commit try to solve error when database initial user created on
master database with socket auth plugin doesn't exist on slave database
because there are running diffrent slapuser.

OPENED ERR00056 : Master user 'slapuser4'@'localhost' is not defined on
replication candidate [2001:67c:1254:e:5:513b:0:5f35]:2199

To add a Database, user should request a slave instance. Each slave
instance is a database.

TODO: Destroy a slave instance should destroy related database

Now that slapos.core on python2 can use softwares on python3, we no
longer need to test for python2

when using golang 1.17 build fail with errors like:

    github.com/jacobsa/fuse/internal/buffer.memclr: relocation target runtime.memclrNoHeapPointers not defined for ABI0 (but is defined for ABIInternal)

Update to wendelin.core 2, which reached its alpha state.

Even though it is wendelin.core 2, it continues to work by default in
wendelin.core 1 mode with providing the same stability guarantees as
before. This mode works with all ZODB4, ZODB4-wc2 and ZODB5. However
every Zope has its own private cache for ZBigFile data which wastes RAM,
prevents us to use as many Zopes as there are CPU cores, and potentially
leads to OOM issues where one Zope tend to allocate whole memory while
other Zopes cannot allocate even a single page. This mode, as well as
previous Wendelin.core 1, is also subject to data-corruption that can
happen on ZBigFile's BTree topology change:

nexedi/wendelin.core@8c32c9f6

WCFS mode - that is what wendelin.core 2 actually provides over
wendelin.core 1 - is currently opt-in. When used in "WCFS mode", all
Zopes share cache for ZBigFile data and there should be no data
corruption. This mode works with both ZODB4-wc2 and ZODB5, but not with
plain ZODB4. The way to opt-in into this mode for a software-release is
to set `erp5-defaults:wcfs-enable-default = true`, like SlapOS Master
currently does:

    # SlapOS Master needs to use Wendelin.core 2.
    # Wendelin.core 2 works with either ZODB4-wc2, or ZODB5, but not with ZODB4.
    # ERP5 does not currently work with ZODB5.
    # -> this leaves ZODB4-wc2 as the only choice.
    [ZODB]
    major = 4-wc2

    [erp5-defaults]
    wcfs-enable-default = true

Remove activate-WC2-preview.cfg as wendelin.core 2 is no longer draft
and there should be no need to use my personal repository and dirty
branch anymore.

Update metabase and fix a few minor problems, mostly:
 - use proper passwords for keystore and for postgresql
 - use Eclipse Temurin JRE, where the SSH tunnels work


See merge request nexedi/slapos!1077

The setup "last,libc,none" allows lazy resolving of backend servers which is
crucial in order to being able to start when the domain does not exists (yet).

Follows dae1747d

This is needed for xlsx export

This solves the issue that ssh tunnels can not be used for database
connections, with sun's java they fail with an error containing:

    JCE cannot authenticate the provider BC

This is an alternate JRE from https://projects.eclipse.org/projects/adoptium.temurin

This version is the one used in metabase docker images

There was missing change in the default value to calculate default maximum
amount of parameters.

This fixes commit 2e6ccd02.

The default virtio-net-pci is not supported by some legacy OSes, so allow
customize it, to provide such support.

This is a dependency of slapos.cookbook[test] since 90650d2c (
recipe/test_postgres: test with a real postgres server, 2021-11-12) and
because we run software schema tests from slapos.cookbook in
software/slapos-sr-testing, we also need the dependency here.

tests with a real postgresql server, the mocked commands from 261a8e6b (test/recipe: update tests for postgres recipe regarding password update, 2021-11-11) were too unrealistic.

These tests with a real server revealed that the port option of the recipe was not used, this is fixed as well

See merge request nexedi/slapos!1083

even though the recipe has a required option for port, it was not used
and server was always listening on default (5432) port