to prevent word splitting and globbing

Starting from OpenSSH 9.0p, scp started to use sftp in favor of the
scp protocol by default. As dropbear in OpenWrt currently does not
support sftp by default, we now use the fallback cli switch "-O"
to use the scp protocol for scp.

Do not fail the new check that good_signatures ≤ #pubkeys.

The scripts directory contains most of our build system, so changing it
should trigger a build of all targets.

- Use printf instead of echo for better portability
- Print whole path without reordering components
- Deduplicate code

Iterating over all the package directories in the OpenWrt feed takes a
while, even though it doesn't contain any upgrade scripts. Skip the
whole directory.

0.7.1 complains about unescaped backslashes in double quotes (which are
intepreted by printf in the two affected places). While the warning was
retired with shellcheck 0.7.2, it seems like a good idea to fix it
anyways.

Using `make container` or, if you don't have automake/gmake on your host
system, `./scripts/container.sh` will build an image for the current
branch your are on and drop you into a shell running inside a container
using that image.

From there all tooling required to work on Gluon is available.

Supports both podman (preferred) and docker.

This has become possible with OpenWrt 21.02 and while the Dockerfile
already received that updated, we forgot to update the CI and the
documentation.

Has gone unused for a while now and if it is needed again it can be
retrieved from the history.

v2: In contrast to the last patches, this is now built on top of ssh
    only, without using e.g. 9pfs. Furthermore it works also with
    arbitary remote hosts on any target/architecture. Also the
    scripts were renamed and moved to /scripts.

The aim of this commit is to allow fast rebuild cycles during the
development of gluon packages.

Currently the following workflow can be used:

	# start a local qemu instance
	scripts/run_qemu.sh output/images/factory/[...].img

	# do your changes in the file you want to patch
	vi package/gluon-ebtables/files/etc/init.d/gluon-ebtables

	# rebuild and update the package
	scripts/push_pkg.sh package/gluon-ebtables/

	# test your changes
	...

	# do more changes
	...

	# rebuild and update the package
	scripts/push_pkg.sh package/gluon-ebtables/

	# test your changes
	...

	(and so on...)

Implementation details:
- Currently this is based on ssh/scp.
- Opkg is used to install/update the packages in the remote machine.

Benefits:
- This works with compiled and non-compiled packages.
- This works with native OpenWrt and Gluon packages.
- This even performs the check_site.lua checks as they are integrated
  as post_install scripts into the openwrt package.
- It works for all architectures/targets.

The kernel build requires rsync.

Currently we do not perform CI firmware builds on the next-2102 branch.

Build Gluon for all branches starting with "next" to increase the
coverage of our build tests.

Signed-off-by: David Bauer <mail@david-bauer.net>

* apt is meant for user interactive usage. apt does not guarantee a stable CLI.
* set DEBIAN_FRONTEND=noninteractive to tell apt-get that no user interaction is wanted

apt does not have a stable CLI interface. Don't use it in scripts.

This reverts commit d9621048.

ubuntu-latest is now assigned to Ubuntu 20.04. As we use custom apt
sources for 18.04, pin to this version for now to fix the CI.

The performance benefit the cache brought was due to a broken sources
CDN mirror handling in OpenWrt.

The cache brings no measurable performance benefit. Disable it to slim
down the pipeline steps.

This adds the ability to cache OpenWrt dependencies on a per-target
base. Artifacts over 10MB are excluded, as GitHub imposes a limit of 5G
of available space per repository cache. This affects mostly
linux(-firmware) and gcc / gdb.

The goal is to reduce the total amount of requests necessary to fetch
dependencies.

Do not mix two different HTTP libraries in one script. This fixes a
warning:

/var/lib/jenkins/slave.py:82: DeprecationWarning: URLopener style of invoking requests is deprecated. Use newer urlopen functions/methods

This simple implementation has the disadvantage that it stores the whole
file in RAM, but this isn't an issue for the 1.5MB slave.jar.

Fixes a warning:

/usr/local/lib/python3.7/dist-packages/urllib3/connectionpool.py:1004: InsecureRequestWarning: Unverified HTTPS request is being made to host 'build.ffh.zone'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings

This allows us to make use of builders that can't run virtual machines.

Drop the TMUX environemnt variable, it's not needed anymore.

- Rely on shebang instead of setting shell in workflow
- Run whole install-dependencies.sh in sudo
- Use /bin/sh instead of bash
- set -e

The new step is added with `if: ${{ !cancelled() }}`, so the logs are
stored even when the build fails.

This will hopefully make CI runs more robust and recover stale workers.

This is required to build the next branch which requires rsync to be
available.