due to outdated pypi version, nemu don't include need moudle in
setup.py, I add them in buildout

use unshare to create new user-root namesapce to have the perrmission to
create network device, use mount to update files information of network
device in /sys(nemu)
test use iptables to manage route condition, miniupnpd to manage upnp,
brctl(nemu) to create bridge, so add them in component.

add openvpn, add babel, modify ovpn-client/server

pim-dm is a python3 only egg and re6st is a python2 only egg.

Deploy pim-dm egg inside a totally separated buildout in python3. 

See merge request nexedi/slapos!1161

See merge request nexedi/slapos!1170

Now the nat-rule-port always has the protocol name, see here:
https://lab.nexedi.com/nexedi/slapos/blob/9a886c4b0c6dd229564292eaa0ef2604fa857aea/software/kvm/instance-kvm.cfg.jinja2#L843

See merge request nexedi/slapos!1166

fixes CVE-2021-33503

fixes PVE-2022-47833

@tomo reports that parts/golang1.17/pkg/obj/go-build takes ~ 1GB which makes it
wasteful if we want to upload result of compilation to shacache.

It turns out we can drop that particular build cache completely, because it is
used only during the build and test of Go itself and its standard library. And
when Go is installed it will be another - "user" build cache - that will be
used to maintain and reuse build artifacts. For the reference: in SlapOS that
latter "user" build cache is located inside go.work/

-> Purge internal build cache after compilation is over.

Size of parts/golang1.17 before and after hereby patch:

before: 1.6G
after:  447M

See also related discussion in nexedi/slapos!929 (comment 128379)

/reviewed-by @tomo, @jerome
/reviewed-on nexedi/slapos!1169

New revision include a fix for waitdatabases which cause repman test instability.

See merge request !1163

Mostly to address the warning in the test that the request parameters
do not comply with schema.

software/{gitlab,nextcloud}: update options to new redis recipe

This changes software/nextcloud to be python3 and software/matomo no
longer need to explicitly use python3 anymore.

This is a fixup of 9a886c4b

This way we don't need to vendor python-redis (so we don't need to
update it for python3 support).

This also change the options in a backward incompatible way:
 - options are now kebab case ( server_bin -> server-bin )
 - a new cli-bin option holding the full path to redis-cli command
 is required to enable promise

This allow to view captured image from the test result log url (snapshot directory).

FIxup of e8220174fdfc386100a4927400d959c50d1be449

Also adapt build.sh for bootstrapping with python3.

This is a fixup of 4b28ab13. See also !1154

Instead of dropping some keys (easy to implement, impossible to test and easy
to leak) create whitelist of passed keys of slaves to the nodes.

Then if there are new keys in slave's connection parameters the nodes are
protected against being polluted with them.