vifib-server: Increase memlock from default 64K to 64M

Wendelin.core 2 tests need to be able to mlock 64M to run.
Increase corresponding limit for all subprocessed spawned by cron, which
covers slapos -> supervisord -> ...

See added comments in slapos_limit.conf for why this has to be done in
/etc/security/limits.d/slapos.conf instead of
/etc/systemd/system/cron.service.d/override.conf

I testd this to work on a KVM of mine with manually putting
/etc/security/limits.d/slapos.conf in place. Before the patch:

    https://erp5.nexedi.net/test_result_module/20201009-341BCC3C/17
    (lots of "OSError: [Errno 1] Operation not permitted" for mlock requests)

After the patch:

    https://erp5.nexedi.net/test_result_module/20201009-6B97A93B/17
    (test.wcfs/fs passes correctly)

/cc @rafael, @tomo, @luke, @Nicolas

playbook/roles/vifib-server/files/etc_systemd_system_cron_service_d_override.conf

@@ -3,3 +3,6 @@
 # (on a normal slapos node server, cron starts slapos, which starts supervisord,
 # which then manage all deployed instances)
 TasksMax=infinity
+
+# NOTE the other limits for subprocesses that cron spawns are defined in
+# /etc/security/limits.d/slapos.conf

playbook/roles/vifib-server/files/slapos_limit.conf

+# Limits for processes run under SlapOS.
+#
+# slapos is started by cron which runs as root user and applies pam_limits.so
+# to spawned processes (see /etc/pam.d/cron for details).
+#
+# For some limits (e.g. memlock), if they are not explicitly defined,
+# pam_limits.so resets them to rather strict default. This means cron/slapos
+# limits cannot be adjusted in /etc/systemd/system/cron.service.d/override.conf
+#
+# NOTE "*", or any other group name, does not cover root user - limits for root
+# has to be explicitly defined.
+
 root             hard    nofile          1048576
+
+# default memlock is 64K originating from ages when machines had ~ 256M of RAM total or less.
+# This days VIFIB machines have at least 16GB of RAM so 64M should not be a big expense.
+# Example use-case: wendelin.core 2 tests need to be able to mlock 64M.
+root             hard    memlock         65536

playbook/roles/vifib-server/tasks/main.yml

@@ -42,7 +42,7 @@
   - file: state=directory path="/etc/systemd/system/cron.service.d/"
     when: systemd_version.stdout | int > 228
 
-  - name: Increase the maximum of subprocesses for cron
+  - name: Increase limits for cron
     copy: src="etc_systemd_system_cron_service_d_override.conf" dest="/etc/systemd/system/cron.service.d/override.conf" mode=0644 owner=root group=root
     when: systemd_version.stdout | int > 228