This will enable the download cache in the package stage, which
currently spends a lot of time with downloading things.

After we can now build with BROKEN, the build for raspi4 should work.

People asked for the Raspberry Pi 4, but it's currently broken and hence
is not build if one doesn't set BROKEN. Thus, allow us to set BROKEN for
some targets to allow these images to be built.

This reverts commit 0df9f251. The target
doesn't seem to be supported, the build failed:

  make[1]: Leaving directory '/builds/firmware/site-ffs/gluon/openwrt'
  Please set GLUON_TARGET to a valid target. Gluon supports the following targets:
   * ar71xx-generic
   * ar71xx-tiny
   * ar71xx-nand
   * ath79-generic
   * brcm2708-bcm2708
   * brcm2708-bcm2709
   * ipq40xx-generic
   * ipq806x-generic
   * lantiq-xrx200
   * lantiq-xway
   * mpc85xx-generic
   * mpc85xx-p1020
   * ramips-mt7620
   * ramips-mt7621
   * ramips-mt76x8
   * ramips-rt305x
   * sunxi-cortexa7
   * x86-generic
   * x86-geode
   * x86-legacy
   * x86-64
  Makefile:158: recipe for target 'config' failed

Previously, we've cached staging_dir in the gluon/openwrt subdirectory.
But this doesn't really work properly because of gitlab's submodule
behaviour. It will first extract the cache and then update the
submodules.

Because the cached directory resides inside the gluon submodule, it will
be deleted upon submodule checkout. By putting the cache in a directory
outside the submodule we can avoid this. We will then simply symlink the
cached directory to the desired destination such that it is found during
the build.

Some server hosting firmware binaries crashed[1] and no mirrors are
available in OpenWRT build system. This causes builds to fail for some
architectures.

To avoid these kinds of failures in the future, add a Git repository
where build jobs will commit their downloaded artifacts. Subsequent
build jobs will check out this repository and use it as their download
directory.

[1] https://github.com/openwrt/openwrt/pull/3573#issuecomment-723530425

As per Gluon recommendation, remove haveged from SITE_PACKAGES:
> Starting with version 19.07 OpenWrt ships the urngd entropy daemon by
> default. It replaces the haveged daemon, for which we removed the
> support in Gluon. Remove haveged from your package selection.

Reference: https://gluon.readthedocs.io/en/latest/releases/v2020.2.html#site-mk

It's not supported by many clients, thus disable for now.

When FFS_BUILD_DATE is not set when make manifest is executed, an manifest
without any images will be generated.

Now that we've moved the make update to its own stage, it makes sense to cache
the whole gluon directory between targets because it won't be overwritten by
make update.

Exchange the signing key used by the CI/CD pipeline with a new key.