It was not pinned on 1.0 branch

from http://www.buildout.org/en/latest/reference.html :

> allow-picked-versions, default: ‘true’
> Indicate whether it should be possible to install requirements whose
> versions aren’t pinned

Setting this to false to make buildout refusing building SR where some
eggs would not be pinned.

Rewriting commit history with `git rebase -i` always caused some
conflicts on md5sum of modified files. `update-hash` made all this
easier, because we could just revert buildout.hash.cfg, re-run
`update-hash` and commit the changes.

This tool makes this scenario a bit more user friendly by automating the
steps by running as a git mergetool.

An interactive rebase session can be initiated by running this command
from software/*/ directory:

`git rebase -i --exec "$(pwd)/../../update-hash $(pwd)/buildout.hash.cfg" origin/master`

and if conflict occur, run:

`git mergetool --tool update-hash-mergetool && EDITOR=cat git rebase --continue`

This way, rebase session can be almost non interactive (still have to
run the above mergetool command) when conflicts are only on md5sum
updates.

/reviewed-on !273

New release of Caddy 0.10.11 with updated quic version (v39). 



/reviewed-on nexedi/slapos!301

   This might be refactored in short future with caucase, however for now this change is required to
   slapos master works.

This is a follow-up of commit 5c980caf,
now that the new code of the 'wrapper' recipe is used (1.0.58 released).

Move and rename the mariadb backup restoration script

With this, we don't loose it (it may help an admin to be able to restore it) and it does not get run by webrunner automatically when updating resilience snapshot

/reviewed-on !304

Run ERP5 tests under [usershosts](https://lab.nexedi.com/nexedi/userhosts) wrapper with the same host mapping as zope instances.

This will allow to simplify configuration of services such as memcached and also be a more realistic environment.

This revealed problems with userhosts, at least on Debian 9,  that have been fixed in nexedi/userhosts!2 , so at the same time we update userhosts to get these fixes.

/reviewed-on nexedi/slapos!303

slapuser4@COMP-2212:~/srv/testnode/bej/inst$ ./test0-5/bin/runner-importer
./test0-5/bin/runner-importer run at : Mon Mar 12 19:55:50 CET 2018
Restoring WebRunner content...
./test0-5/bin/runner-importer: line 49: cd: /srv/slapgrid/slappart4/srv/testnode/bej/inst/test0-5/srv/backup/runner/runner/: No such file or directory

With this, we don't loose it (it may help an admin to be able to restore it) and it does not get run by webrunner automatically when updating resilience snapshot

To get fixes from nexedi/userhosts!2

The main reason is to fix inkscape segfaults that break ERP5's svg to
image conversion.

We are supposed to have valid certificates and if really needed,
slapos.recipe.build:gitclone can ignore it.

reviewed on nexedi/slapos!300

thx @jerome

Depending on host python version the string "Build successful" renders
differently, so do not be too smart for it and simplify it.