See merge request !1013

- rubygemsrecipe deployment mode now depends on `allow-picked-versions` by default

sotware/caddy-frontend: Use instance-caddy-replicate.cfg to replace buildout-switch-softwaretype.cfg

Because when using the switch-software, the
buildout-switch-sofwtwaretype.cfg will not be generated, see
https://lab.nexedi.com/nexedi/slapos/blob/master/slapos/recipe/softwaretype.py#L264-267
So use instance-caddy-replicate.cfg instead, which has same effect.

Changes explanation:
slave_reference.lower(): The configparser which the current buildout
using is case sensitive, which cause some options cannot be found.
slap_software_type: The recipe softwaretype need this option, but
switch-softwaretype doesn't.
caddyprofiledeps: It provides the deps of caddy. Switch to
switch-softwaretype leads to the error like "ImportError: No module
named furl". Force caddyprofiledeps installed first can solve this
issue.

See theia's [changelog](https://github.com/eclipse-theia/theia/blob/v1.16.0/CHANGELOG.md#v1160---7292021), we update from 1.13.0 to 1.16.0.

Changes specific to slapos port:
 * We set `warnOnPotentiallyInsecureHostPattern` because the new warning is very intrusive ... but it might actually be very insecure. For now we don't have solution. We are tracking this in https://erp5js.nexedi.net/#/bug_module/20210819-20614EE
 * New libsecret component that is now required by theia
 * Switch to using vscode git instead of theia git, to use timeline ( see https://github.com/eclipse-theia/theia/pull/7997 )
 * globally version up slapos.core to https://pypi.org/project/slapos.core/1.6.18/

See merge request !1039

To have the timeline view

This is basically the same problem as in 1b291415
(component/ghostscript: Workaround for slaprunner paths with double
slashs, 2021-06-02)

The issue is now fixed in 1.16.0

Eventhough our current pattern is not the most secure, we have no other
choice for now that to use such insecure patterns.

In https://erp5js.nexedi.net/#/bug_module/20210819-20614EE we track possible
improvements to this situation.

This new version has a dependency to libsecret

Also adjust dependencies to the ones from https://github.com/eclipse-theia/theia/blob/v1.16.0/examples/browser/package.json
except api-samples which is not useful.

See merge request !1027

See merge request !931

The resiliency pull-backup-server status feed file `pbs-status-rss`
is generated by a cron running every 5 minutes. But there is a promise
that requires it to check the notifier status, meaning instanciation
fails until this file is available.

To allow the promise to succeed immediately, we generate the
feed a first time directly from buildout.

The resiliency notifier status feed file `notifier-status-rss`
is generated by a cron running every 5 minutes. But there is a
promise that requires it to check the notifier status, meaning
instanciation fails until this file is available.

To allow the promise to succeed immediately, we generate the
feed a first time directly from buildout.

See merge request !1041

we need to be explicit for extras.
Ping egg.

With multiple security fixes

See merge request !992

Follow-up for commit 98e7a29a (component/trafficserver: Version up to
9.0.2).