to support git 2.38.1

This is a big changes for users, now typing "python" on the command line
will use system python if it exists or fail with "command not found".

`python3` is set to the SlapOS python from Theia software release.
Recommended approach for python users is either to get used to type
`python3` or to create a virtualenv and use it. With the virtualenv,
they can also install pylint or other linters, so this might be the
best thing to do.

This solves two problems:

First problem is that it makes the embedded SlapOS always have a python
interpreter as `python` in $PATH, which is not always the case in other
SlapOS usage and can hide problems that would cause a software to build
successfully in Theia but not in "bare metal" SlapOS.

Second problem problem is that on python was a interpreter from pygolang
and it is not perfect regarding line edition at least on python 3.8, as
we can observe in this session:

run python and type "something":

```
Python 3.8.13 (default, Sep  6 2022, 10:45:07)
[GCC 8.5.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> something
             ^ cursor is here, as expected
```

type Ctrl+A to go to beginning of line:

```
Python 3.8.13 (default, Sep  6 2022, 10:45:07)
[GCC 8.5.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> something
    ^ expected cursor position
^ actual cursor position
```

likewise, type Ctrl+E to go to end of line:

```
Python 3.8.13 (default, Sep  6 2022, 10:45:07)
[GCC 8.5.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> something
             ^ expected cursor position
         ^ actual cursor position
```

In some cases, for example when the instance does not have internet
access, or to speed up slapos node instance, it's better not to have
frontend requests in the embedded slapos. In this case, the default
slapos proxy behavior of returning a "fake frontend" [1] will apply
and promises checking frontend status will pass anyway.

[1]: see slapos.core commit 2a53efca2 (proxy: bypass simple fronten
requests by returning URL, 2019-03-25)

bring fixes for about 20 CVE

with support for aborting query ( https://github.com/mroonga/mroonga/issues/344 )

Configuring failover URL and being able to rely on cached content is not so
simple, thus document the requirement and prove in test, that such
configuration works correctly.

Checking SLAPOS_TEST_DEBUG in the test itself came from ancient history of the
testcase, it's time to drop it and use modern apporach.

This includes xmlsec, the C library and its python bindings in ERP5, using the latest versions that are compatible with python 2.

`1.3.9` is the latest version of the python bindings with python 2 support and `1.2.30` is the latest version of the C library compiling with this version of the python bindings.

See merge request nexedi/slapos!1272

Since slapos.core!436 requesting with `--parameters-file` requires
that a JSON schema exists at <sr-url>.json for the requested SR.

Missing trailing /

See nexedi/slapos@5e1ff2de

zlib source url has been moved. Please see issue
https://github.com/madler/zlib/issues/649 for reference.

See merge request nexedi/slapos!1276

Co-authored-by: Kazuhiko SHIOZAKI <kazuhiko@nexedi.com>

Running test as last makes no sense nowadays, as the site is fully prepared.
Awaiting for each possible log of configured frontend is not worth the
requirement, so make those tests as first ones, which simplifies running only
them with reproducible effect.

All tests which could be affected by that fact has been identified and changed.

otherwise it probably uses system's openssl.

Setting rpath seems not needed because we are using
-DBUILD_SHARED_LIBS=OFF here.

https://github.com/sigoden/dufs

New software to serve static files

See merge request nexedi/slapos!1270

caddy-frontend-N is bad name, it's just frontend-node-N.

This option was useful only during the time, when there were experiments
running on caddy-frontend clusters during switch to HTTP/2.

Currently HTTP/2 is a standard, and there is no reason to disable it globally.

Attention, this change will require manual intervention on the upgraded
cluster with:

sed -i 's/^recipe = caddyprofiledeps/recipe = software/g' .installed*

On each partition.

NAME_BASE is set on top of the file with informative warning, so that
developers are aware of consequences.