/reviewed-on nexedi/slapos!415

/reviewed-on nexedi/slapos!408

isp data is from https://www.whoismyisp.org/ip
cn-t for china telecom, default one if isp is other value
cn-m for china mobile
cn-u for china unicom

fix rst syntax - second try

fix markdown syntax

from !408 (comment 66703)

as always, using wrapper is easier and more flexible

also use a real bash and not busybox

   bzip.org don't exist anymore, download from fosseis is ok as the md5sum guarantee we still get the same file.

/reviewed-on !406

LIBPCRE1_JIT is required to compile git-2.17.1, so we enabled jit in pcre component. Another solution will be to compile git with NO_LIBPCRE1_JIT=1 and keep jit disabled in pcre.

when accessing gitlab URL ex: lab.nexedi.com from renderjs, URL is blocked because there is no CORS.
Set cors header directly in nginx configuration, so that it's not required to create custom slave frontend configuration to include Access-Control-Allow-Origin

Gitlab-ce upgraded to version 8.17.8 with required gitlab-shell version 4.1.1-1 and gitlab-workhorse version 1.3.0.
Configurations and wrapper upgraded to work with the current version.

Each slave rejected by the frontend will report back detailed information
to slave requester in key request-error-list being [json_list_of_found_errors]

Master partition reports information in rejected-slave-dict instead of
rejected-slave-list, which is defined as:

{
  'slave_name': '[json_list_of_found_errors]'
}

Globals were needed to distnc between caddy-frontend and apache-frontend.

kill -SIGXXX works only in bash and not when the shell is e.g. dash, for
example:

	$ kill -SIGUSR1 1
	/bin/sh: 2: kill: Illegal option -S

This way log rotation for slapproxy.log & friends was not properly working.

Fix it by using `kill -XXX` form which is supported everywhere.

/reviewed-on nexedi/slapos!402

Finally, last change in erp5testnode is not needed, it was just required
to fix seleniumrunner software

As Age value can vary and it is not predictable, assert its existence only.

The case of firefox 60 described in the commit messages showed that we should not use `$TMPDIR` instead of `/tmp` in our patch to isolate `$DISPLAY`s.

This introduce a new environment variable `XORG_LOCK_DIR` with clearer semantics.

Softwares relying on this have been updated or removed when not used.

The following softwares where already OK:
 * ERP5 and erp5testnode did not set `$TMPDIR` and were using `/tmp/`
 * cloudooo runs in `--headless` mode

/reviewed-on !394

current version failed to build in gcc6
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=811741

Slaves' hostnames (custom_domain or server-alias) can clash, resulting
with stopping the whole frontend.

In order to avoid so assure hostname unicity across whole frontend.

Even if the master partition owner will authorise given slave for custom
configuration reject this slave in case if it does not pass validation for
snippet.