Set cache.direct=on when using native aio (needed by qemu)

/reviewed-on !399

Instead of relying on slapos.cookbook:certificate_authority recipe, which
stops buildout processing, extract the minimal implementation to runtime
key/certificate validator and reject slaves, which does not pass this test.

This commits results in TODO item being done.

As slave requester is able to enter any string in server-alias validate it
against being correct domain name and in case if validation fails reject that
slave.

Also use a trick to have access to global slave state, see
https://fabianlee.org/2016/10/18/saltstack-setting-a-jinja2-variable-from-an-inner-block-scope/

Install validators dependency, which is a way to easily check if email is an
email or domain is correct.

As slave requester is able to enter any string in custom domain validate it
against being correct domain name and in case if validation fails reject that
slave.

Create caddyprofiledeps egg with dummy noop recipe.

Thanks to setting dependencies of this egg and enabling it on the instance
profile, buildout will install eggs during software run and activate them
during instance run.

No existing egg (like slapos.cookbook) is used, as this technique is to allow
profile/software release developer to choose required eggs used during
instantiation.

Another apporach would be to add dependency for validators in
slapos.recipe.template (in install_requires).

Thank to escaping whole command-line it is possible to process buildout
dangerous strings, like ${section:option}, pass them to the wrapper,
instead of killing the whole profile processing.

If the value does not contain "," drop its contents instead of stopping
processing of the whole profile.

Instead of needlessly storing information in configuration section, pass it
via jinja2 parameter. This is safe, in case if extra_slave_instance_list
would contain value like ${section:option}.

There is a way to pass monitor port to each replicated frontend by using
frontend-config-N-monitor-httpd-port, thus there is no need to pass through
the default value, as it comes default on each replicated slave.

:develop is a bit special in that it does not install the egg, but just
tell buildout that this directory contain the egg, so that recipes that
will install this egg later will pick the develop-eggs.

  Allow the KVM software release request a disk via plugin,
  if the plugin is enabled the chown will be set to give the disk to the partition.

Add plugin assertions in TestSlave.test_master_partition_state and drop
check-free-disk-space from promise directory.

/reviewed-on !380

As check-free-disk-space promise is implemented in plugin directory, add it
to list of assertions and drop it from promise list assertions.

Also already existing monitoring plugins are asserted.

This release should be now stable enough for release

/reviewed-on !391

In preparation for moving this to a better place, use the same code in
all the places where this code was duplicated.

Reconcile all implementations, document a little bit more the methods
and the future plans.

Major change is that slapos compatible wrapper is no longer installed in
parts/firefox/firefox-slapos , but directly as "firefox" in the
buildout:bin-directory of the software profile.
geckodriver is also in the same buildout:bin-directory.
This way, softwares using this just need to add
buildout:bin-directory to $PATH

erp5testnode knows since
erp5@59ee7970
that it should look for firefox in buildout:bin-directory of the
installed SR, so we should not need backward compatibility here.

Adjust seleniumrunner and jstestnode for the changes

Also drop unused firefox 45

Jérome changes from original 8cf6908d :
 - name sections [firefox-wrapper] and [firefox] because including the
version in section name means we have to also update section name when
we update version. Users have to be careful of installing
${firefox-wrapper:} and not ${firefox:}
 - introduce macros for implementation and simple section using the
macros, to make it easy to had more versions or to increase versions,
for both firefox and geckodriver. They are slightly different because
for firefox we need a wrapper, but geckodriver is usable directly.
 - use same version, the "versions up" will be separate commits.
 - now that seleniumrunner and jstestnode are using buildout.hash.cfg,
md5sums are in separate files.
Co-authored-by: Jérome Perrin <jerome@nexedi.com>

  it  clean up....

  Up to some extent we would like to set diskcache=none and diskaio=native

This reverts commit 9b3dfa01

On runner importer script, when updating database, set timeout to 5 seconds (same value as the default in python sqlite3 module: https://docs.python.org/2.7/library/sqlite3.html#sqlite3.connect). If database is locked by another process we wait a bit instead of raise immediately "database is locked". Importer script will raise if database is locked for more than 5 seconds.

/reviewed-on !384