See merge request !1170

Now the nat-rule-port always has the protocol name, see here:
https://lab.nexedi.com/nexedi/slapos/blob/9a886c4b0c6dd229564292eaa0ef2604fa857aea/software/kvm/instance-kvm.cfg.jinja2#L843

See merge request !1166

fixes CVE-2021-33503

fixes PVE-2022-47833

@tomo reports that parts/golang1.17/pkg/obj/go-build takes ~ 1GB which makes it
wasteful if we want to upload result of compilation to shacache.

It turns out we can drop that particular build cache completely, because it is
used only during the build and test of Go itself and its standard library. And
when Go is installed it will be another - "user" build cache - that will be
used to maintain and reuse build artifacts. For the reference: in SlapOS that
latter "user" build cache is located inside go.work/

-> Purge internal build cache after compilation is over.

Size of parts/golang1.17 before and after hereby patch:

before: 1.6G
after:  447M

See also related discussion in nexedi/slapos!929 (comment 128379)

/reviewed-by @tomo, @jerome
/reviewed-on nexedi/slapos!1169

New revision include a fix for waitdatabases which cause repman test instability.

See merge request nexedi/slapos!1163

Mostly to address the warning in the test that the request parameters
do not comply with schema.

software/{gitlab,nextcloud}: update options to new redis recipe

This changes software/nextcloud to be python3 and software/matomo no
longer need to explicitly use python3 anymore.

This is a fixup of 9a886c4b

This way we don't need to vendor python-redis (so we don't need to
update it for python3 support).

This also change the options in a backward incompatible way:
 - options are now kebab case ( server_bin -> server-bin )
 - a new cli-bin option holding the full path to redis-cli command
 is required to enable promise

This allow to view captured image from the test result log url (snapshot directory).

FIxup of e8220174fdfc386100a4927400d959c50d1be449

Also adapt build.sh for bootstrapping with python3.

This is a fixup of 4b28ab13. See also nexedi/slapos!1154

Instead of dropping some keys (easy to implement, impossible to test and easy
to leak) create whitelist of passed keys of slaves to the nodes.

Then if there are new keys in slave's connection parameters the nodes are
protected against being polluted with them.

Needed for `six` to avoid such message on:
  + from past.builtins import cmp
    => Redefining built-in 'cmp' (redefined-builtin)
  + from six.moves import xrange
    Redefining built-in 'xrange' (redefined-builtin)

Python2 already provides __code__ and __defaults__ so this just does the same on
PythonScript.