bring fixes for about 20 CVE

slapos.cookbook:haproxy no longer exist

See merge request nexedi/slapos!1278

Put broken python interpreters in path so that fail if they try to use
system python

We should not use $PYTHON, because this implicitly depends on the
python version that was used when the shared part is installed, leading
to this kind of problematic scenarios:
 - install the part from a python2.7 software, this creates scripts
  with "python2.7" in shebang line
 - install a python3 software referencing glib, it uses the shared
  part that was installed with python2, but "python2.7" is not in $PATH

By referencing the part explicitly, it becomes part of the signature
of the part, so a software on python2 and a software on python3 will
use a different version of the shared part.

945a2e97 (proxysql: bundled libinjection needs Python 2, 2021-12-23)
addressed the problem that proxysql was using system python, by placing
slapos' python in $PATH, but it added it after default $PATH, which
made proxysql use system python if available and only fallback to
slapos' python.
This changes the order of $PATH entries to always use slapos' python

python or python2 is system python, which we want to avoid

with support for aborting query ( https://github.com/mroonga/mroonga/issues/344 )

Configuring failover URL and being able to rely on cached content is not so
simple, thus document the requirement and prove in test, that such
configuration works correctly.

Checking SLAPOS_TEST_DEBUG in the test itself came from ancient history of the
testcase, it's time to drop it and use modern apporach.

This includes xmlsec, the C library and its python bindings in ERP5, using the latest versions that are compatible with python 2.

`1.3.9` is the latest version of the python bindings with python 2 support and `1.2.30` is the latest version of the C library compiling with this version of the python bindings.

See merge request nexedi/slapos!1272

Since slapos.core!436 requesting with `--parameters-file` requires
that a JSON schema exists at <sr-url>.json for the requested SR.

Missing trailing /

See nexedi/slapos@5e1ff2de

zlib source url has been moved. Please see issue
https://github.com/madler/zlib/issues/649 for reference.

See merge request !1276

Co-authored-by: Kazuhiko SHIOZAKI <kazuhiko@nexedi.com>

Running test as last makes no sense nowadays, as the site is fully prepared.
Awaiting for each possible log of configured frontend is not worth the
requirement, so make those tests as first ones, which simplifies running only
them with reproducible effect.

All tests which could be affected by that fact has been identified and changed.

otherwise it probably uses system's openssl.

Setting rpath seems not needed because we are using
-DBUILD_SHARED_LIBS=OFF here.

https://github.com/sigoden/dufs

New software to serve static files

See merge request !1270