this replaces the "-h db.torproject.org" pattern, which no longer works
on bookworm, to "-H ldap://db.torproject.org", which does

Those are typically trashed at the end and overlap with the following
dsa-check-packages.

I've done a bunch of upgrades without screen on because of this: I
would return to step 4 and just follow it, not copy-pasting from the
previous step. This is actually how it's done in the other step, so
this also happens to be more coherent.

This might have added something to sources.list, in this case
non-free-firmware, in particular.

One has to wonder why we even have that line now... Surely that cleans
itself up later?

all of those are managed by puppet and some have been updated to
reduce the diff as well, others will be marked as todo.

this is an old symlink that used to be installed by Puppet, and it's not
needed anymore

on bullseye, this generates the error "E: input:25-44: error:
Unrecognized pattern '?codename'"

We're trying to reduce the odd software we run, and now apt itself is
quite capable of doing such detections on its own.

This was kind of scattered all over the place and not directly linked
from the (most usual) Ganeti procedure. Now we have the procedure all
in one shot, and with the fat warning about the most common error I've
done twice already.

Used with success in team#41258.

unsure currently if this affects all bookworm upgrades, but if it looks
like it, we should add this to the main upgrade procedure.

What we've discovered (with @lavamind) is that the token
policy *restricts* the user policy, so we actually need both. We
selected to do a bucket per service, and a token restricted to the
bucket.