this replaces the "-h db.torproject.org" pattern, which no longer works
on bookworm, to "-H ldap://db.torproject.org", which does

Those are typically trashed at the end and overlap with the following
dsa-check-packages.

I've done a bunch of upgrades without screen on because of this: I
would return to step 4 and just follow it, not copy-pasting from the
previous step. This is actually how it's done in the other step, so
this also happens to be more coherent.

This might have added something to sources.list, in this case
non-free-firmware, in particular.

Add a space to the password writing so it hopefully doesn't go to
shell history.

Also add a configuration error I stumbled upon locally.

One has to wonder why we even have that line now... Surely that cleans
itself up later?

all of those are managed by puppet and some have been updated to
reduce the diff as well, others will be marked as todo.

this is an old symlink that used to be installed by Puppet, and it's not
needed anymore

on bullseye, this generates the error "E: input:25-44: error:
Unrecognized pattern '?codename'"

We're trying to reduce the odd software we run, and now apt itself is
quite capable of doing such detections on its own.