No predicable files in /tmp!

Currently gated behind the "slsaversion:v1" build flag for
testing purposes.

Also add/rename entries in BSRekor.

Use this to make sure we do not delete container blobs that are
still needed.

See https://github.com/opencontainers/distribution-spec/pull/66

This was broken with commit 13f89b13 where
we changed the code to already append the repository to the gun.

Also bring the code more in sync with the source server by
adding a $type variable.

We need to do a rebuild if the updateinfo is changed, e.g. if
a patchinfo gets retracted.

In that case we subtract the number of cosign tags, as querying them
does not take time.

This flag keeps the artefacts of deleted packages published. It
is only checked if the project has publishing disabled.

We do not want to crash the scheduler, but return a meaningful
error.

We need to get rid of all the memory used in the publish process.

If nofork is set to -1, the runner will wait for all children
to finish before running the request in forked mode.

We need this to survive having many aggregated binaries from
multiple packets in one single packets, e.g. a big patchinfo.

This has the same drawback as the binary architecture filter,
i.e. it must match what the product composer does.

This is useful for reducing the binaries the worker has to download.
It es especially needed if the package is a patchinfo that contains
multiple architectures.

The downside is that the code must match what the product composer
code does.

Do not create a copy of the data we read.

We used to read them into memory instead of creating a hard link.

We use a "unblocked" retry event for this. It translates to a medium queue
entry which should be good enough for our use case.

Instead do it once for every repository.

The listfile is in the format of the list mode, i.e. it contains
the tag, digest, type, and extra info.

The plan is to replace the digestfile with the listfile in
the future. For this to happen we would need to add the manifest
size as additional output.

Backend considers maintenance_release projects by default
as build disabled now. We use one in our fixtures as special
case so enabling it explicit there.

This just sets the default for the build flag, you can still
enable it again in the project meta data.

We can use the last result in the query by using the "If-None-Match"
http header in the manifest request.

While the man page states "if something bad happens, an exception
is generated" it also declares that IO errors or truncated data
are not critical and just lead to an return value of undef.

The source server code cannot deal with it.

Use chunked encoding and send in 64K chunks using the datafmt
feature.