This skips replication bootstrap and requires that all binlogs be still
available on the primary. This is useful when the primary is recent and
does not have a ready backup for bootstrap yet, or when all binlogs are
still available and skipping the bootstrap seems more efficient.

Allow requesting a mariadb set-up to replicate another mariadb:
- bootstrap-url: bootstrap from a statically served backup file
- primary-url: replicate from a primary mariadb

This happens in mariadb first initialization, when no data exists yet.
That way existing data in a non-replicating mariadb cannot be deleted
by setting the replication parameters after the fact.

A promise checks that the state (replica / primary, replication source)
of the running mariadb matches the requested state; but if it doesn't,
the mariadb will not automatically converge without human intervention
if ~/srv/mariadb data directory already exists, to avoid deleting data.

This service does on-the-fly modifications on the running mariadb that
can conflict with and break replication and are anyway unneeded in the
replica.

Maybe this service should be dropped entirely and its functionality be
implemented another way.

Use a generated password and publish its url.

Remove

```
[gcc:python2]
part = gcc-8.5
```

from neoppod/software-common.cfg and dream/software.cfg as it causes
gcc being pinned to a different version before and after rebootstrap
when the initial python version is not Python2.

This reverts dc91e5d4.

When use-ipv6 is enabled, make mariadb publish an url of the form:
  `mysql://user:password@[ipv6]:port/database`

instead of:
  `mysql://user:password@ipv6:port/database`

which results in the zope instances crashing during processing
due to urlparse.urlsplit failing to parse the url.

See merge request nexedi/slapos!1714

Fixes handling failed backups and default_exception_handler.

See merge request nexedi/slapos!1685

Stop using deprecated ssl.wrap_socket, and let unset key-file mean
the key is included in cert-file, as is done in python ssl module.
Also let the server crash if specified cert-file or key-file does
not exist, instead of silently falling back to non-TLS http.

Add 'socketpath' and 'abstract' options for path based unix sockets
and abstract unix sockets respectively.

See merge request nexedi/slapos!1716

See neoppod@f4a5fe3b.

This was sometimes causing false positives, for example if site have
only one hit and this hit takes more than one second, apdex is 0% and
promise failed, it seems useful to at least have a way to disable.

We are discussed on !1716 (comment 225941)
an idea of introducing a "minimal number of hits" parameter to not
detect this false positive on sites that are not accessed enough to
calculate a meaningful apdex.

Needed for password authentication to websocket
A bug was discovered in previous version

See merge request nexedi/slapos!1717