Instead of complex architecture in the profiles, reuse kedifa-updater
capability to do backward compatibility certificate management thanks to its
fall-back mechanism.

kedifa-updater uses state file to know, if it ever succeed to download
certificate from KeDiFa, and so it really makes it that pushing at least once
certificate to KeDiFa, even if it is sometimes unresponsive, will switch to
it.

Fallback certificate is used, thus each slave listens immediately on HTTP and
HTTPS. Thanks to this, asynchronous updates do not need to communicate with
slapos node instance, and slapos node instance does not care about the
certificates anymore.

Instead of fetching certificates on each slapos node instance use new
kedifa-updater, which is a tool to asynchronously fetch certificates and
has a hook to reload the server in case if new certificate is available.

custom_ssl_directory is NOT BBB

This mostly useful during tests to have stable results, especially when
some slaves are rejected.

This change is expected to be no-op during normal run.

Note: The slave rejection system does not guarantee any ordering, as the sort
      order can change, because of parameters can reorder slaves. Thus, even
      if slave A was requested before slave B, and they conflict each other,
      slave A can be rejected instead of "expected" slave B.

This is consistent across usage in caddy-frontend and allow better reusage.

Section was not renamed in buildout.hash.cfg

perl was upgraded from version 5.26.1 to 5.28.1 in
8d4fa263

Helloweb is small app, which is very good place to use the most recent go
always.

Contains many bug fixes found since 1.12, see
https://golang.org/doc/devel/release.html#go1.12.minor

SLAPOS-SR-TEST-MASTER sometimes reveal errors:
```
Can't locate Getopt/Long.pm in @INC (you may need to install the Getopt::Long module)
...
makefile:588: recipe for target 'cpan/podlators/pm_to_blib' failed
make: *** [cpan/podlators/pm_to_blib] Error 25
```

Backport a fix for this problem discussed at https://rt.perl.org/Public/Bug/Display.html?id=132360

/reviewed-on !542

This folder contains binlogs, which are written on every transaction
commited in mariadb. As it is not an immutable file, it shouldn't be
part of the backup, even if its path is confusing...

/reviewed-on !540

--force with --check-anomaly makes monitor.runpromise execute the promise
unconditionally, even for testless ones.

Update versions and tweak a bit python language server config.

After some investigation, I understood that completions where slow for us because jedi add some [buildout support](https://github.com/davidhalter/jedi/blob/cef769ecd8b3a50cd0784d8660b123f4bf0eaec2/jedi/evaluate/sys_path.py#L132-L137) which walks up directories to find a `buildout.cfg` and inspects the corresponding scripts in `bin` to find python package paths. On web runner I have 98 scripts in `~/bin/`, each of them adding between 30 and 50 entries to `sys.path`.

A quick workaround is to create an empty `buildout.cfg` in the current directory or a parent directory before editing python code.

/reviewed-on nexedi/slapos!509

/reviewed-on nexedi/slapos!539

Building Bison 3.3.2 now requires autoconf.

fixup for af247599: Put automake
in $PATH instead of creating its own environment variable.

Needed for kedifa!2

/reviewed-on !537

otherwise hdf5.so cannot be found on compilation of h5py

more-itertools is a hidden dependency, not managed by buildout.
It has dropped support for python2 after version 5.0.0

/cc @tomo @jm

/reviewed-on !536

This partition contains no data worthy of backup:
- only in-transit emails appear
- logging is (sadly) not local to the partition

- Use `xz-utils` component for log file compression
- Fix some stacks and software releases to use the logrotate stack instead of re-creating it:
  - `software/caddy-frontend`
  - `stack/resilient`

/reviewed-on !508