MAR-245: Fix some linting errors in documentation:

- Use proper truthy YAML expressions.
- Explicitly specify file permissions.

MAR-242: Added role parameter to xmpp_server role for configuring uploaded file expiration (XEP-0363):

- Also reworded and harmonised related role parameter descriptions.

MAR-242: Added role parameters for xmpp_server role to configure HTTP file upload limits (XEP-0363):

- Refactor the daily quota tests to be a bit more flexible.

MAR-240: Tag dropped packet messages in system log (due to rate-limiting):

- Improves visibility of such messages, making it easier to
distinguish them from other firewall-related messages.
- Update documentation to mention that the messages are logged.

MAR-236: Add auxiliary object class to LDAP directory for optional countryName and friendlyCountryName attributes:

- Makes it easier to specify free-form optional country name in
LDAP-backed address books.
- Object class uses Majic-specific PEN (Private Enterprise Number)
"namespace" - 1.3.6.1.4.1.40926.417.2.1 (40926 is Majic PEN, 417
stands for LDAP, 2 stands for object class, and 1 is incremental
sequence number). The 417 is result of adding together lower-cased
letters LDAP in their decimal value.

MAR-233: Add IPv6 connectivity tests for the mail_server role:

- Include an example of IPv6 address in documentation for the
smtp_allow_relay_from role parameter (has to have square brackets to
make it usable with Postfix configuratin).
- Expand the tests and test parameters to ensure IPv6 is properly
covered.
- Reorder the names in /etc/hosts slightly to ensure the ansible_fqdn
and inventory_hostname match-up. Code should be revisited to
probably drop the use of inventory_hostname from both roles and
tests, and instead rely on ansible_fqdn and ansible_hostname.
- Correct the Dovecot SSL DH parameter specification to use
ansible_fqdn for consistency purposes.

MAR-230: Updated documentation, inline comments, and some tests related to TLS configuration:

- Documentation and comments should be a bit more consistent across
the roles now.
- Try to follow same rule for inclusion of singular TLSv1.2 cipher
across the board in affected tests.

MAR-230: Drop support for older TLS versions from the xmpp_server role:

- Update documentation.
- Include TLSv1.3 ciphers in default configuration for documentation
purposes - although ciphers are not configurable.
- Update the tests. Drop the workarounds for enabling the older
versions via OpenSSL policies.

MAR-230: Add support for TLSv1.3 to the mail_server role:

- Tests/support for older versions have already been dropped
previously.
- Document the specifics of TLSv1.3 cipher configuration.
- Update tests. The DH param test is now applicable only for the
mandatory parameter test servers.

MAR-230: Add support for TLSv1.3 to the ldap_server role and drop TLSv1.1 from tests:

- Update the role defaults, make sure to include additional priority
strings for TLSv1.3.
- Document the specifics of TLSv1.3 cipher configuration.
- Update tests.

MAR-230: Add support for TLSv1.3 to the web_server role and drop TLSv1.1 from tests:

- Update the role defaults, make sure to include additional ciphers
for TLSv1.3.
- Document the specifics of TLSv1.3 cipher configuration.
- Update tests, dropping the hack/workaround that allows use of weaker
TLS protocols.

MAR-218: Drop documentation references to only Python 3 being supported:

- The project is at this point only supporting Python 3, and all
modern distros support only Python 3 nowadays. No need to be
explicit anymore.

MAR-232: Switch to using IP addreses in firewall rules for mail_forwarder role:

- Perform lookups on managed machine for the passed-in SMTP relay
host, and use those values when populating the firewall rules.

MAR-226: Harmonise the HTTP header override parameter between the PHP and WSGI website roles:

- Use the new naming/syntax introduced in the php_website role since
it implies less dependence on the backend application (more generic
name for it), and is a little bit saner in terms of not having to
provide quotes as part of the value.

MAR-192: Drop rsyslog/logrotate configuration for ldap_server role under Debian 12 Bookworm:

- Default installations of Debian 12 Bookworm no longer come with
rsyslog pre-installed (and it is considered to be deprecated as
default system logger under Debian 12 Bookworm).

MAR-192: Added support for Debian 12 Bookworm to xmpp_server role:

- Some of the tests are still failing, namely the ones centered around
the sendxmpp tool (which seems completely broken at this point in
Debian 12 Bookworm)

MAR-192: Added support for Debian 12 Bookworm to mail_server role:

- Allow use of older versions of TLS on Bookworm for testing of
related optional parameters.
- Install the IMAP CLI testing tool under its own virtual environment
in order to avoid warnings and errors when trying to install it
globally under Debian 12 Bookworm.
- Update the lists of expected TLS protocols and ciphers.

MAR-192: Added support for Debian 12 Bookworm to wsgi_website role:

- Update list of Python packages that are installed for running the
tests.
- Paramterise Python version testing (depends on distribution
release). Use similar construct like for the php_website role.

MAR-192: Added support for Debian 12 Bookworm to web_server role:

- Some tweaks had to be done to test the TLS, but it would be useful
to revisit the TLS configuration in general in the future, and to
modernise it for TLSv1.2 and TLSv1.3, especially once the supports
for Debian 11 Bullseye is dropped.

MAR-192: Added support for Debian 12 Bookworm to database_server role:

- Newer versions of MariaDB are planning on making the utf8 become a
default alias for utf8mb4. Stick to utf8mb3 currently for
compatibility purposes.

MAR-192: Added support for Debian 12 Bookworm to backup_server role:

- Use test parametrisation instead of looping over a list when testing
correct key usage.
- Replace deprecated key algorithm (in Debian 12 Bookworm) for test
purposes (it just needs to be one of the RSA variants).

MAR-192: Added support for Debian 12 Bookworm to common role:

- Use slightly more memory for Debian 12 Bookworm VMs, they have a
tendency to OOM otherwise (march of progress).
- Update regex for matching the DIR_MODE confiuration in Debian 12.
- Remove NTP pacakges if ntp_pools parameter was not set.

MAR-192: Switch to using NTP pools instead of servers:

- This is the recommended configuration by NTPsec, and also default on
Debian. Previuosly suggested values for servers have been pool
addresses in any case.

MAR-192: Added support for Debian 12 Bookworm to backup_client role:

- Drop the orphan config file for backup server helper.

MAR-195: Reject mails with non-matching sender for logged-in users:

- Prevents logged-in user from setting "MAIL FROM" with e-mail address
that does not match either his own account or one of the aliases
that the user receives mails from.
- Reworked the submission port configuration to restrict only based on
sender-related restrictions, merging some of the newer changs from
the workaround.org instructions.

MAR-196: Simplify allowed TLS protocol configuration for mail_server role:

- Accept minimum version allowed instead of arbitrary list.
- Fixes deprecation warnings in Dovecot logs (ssl_protocols ->
ssl_min_protocol transition).

MAR-194: Use IP addresses instead names for maintenance allowed connections:

- Less ambigious. Solves problems around names being resolvable to
different IPs depending on what DNS server is used.
- Parameter renamed to better represent what is specified.
- Updated requirements to allow execution of ipv4/ipv6 filters.
- Pin the rich requirement to a lower version for compatibility
reasons.
- Implement tests for IPv6 connectivity tests.
- Improve rendering of base rules (indentation).

MAR-197: Implement environment indicator for the web_server role:

- Now the environment indicator will also cover the default landing
page for the web server.
- Tweaked the landing page to look a bit better in terms of
margins (particularly important for the environment indicator).

MAR-198: Implement removal of expired backups via backup_client role:

- In addition to expired backup removals, ensure that the backup
does not proceed if previous execution step has failed. This means
that pre-scripts now have to run without errors for the main backup
to kick-in.
- Could not use full _and_ chaining of duply. For example, if we have
A_and_B_and_C (where A/B/C are duply backup commands), if A
fails, B will be skipped, but C will still run because B has ran
without_errors.

MAR-154: Update documentation and test site for Python 2.7 support removal:

- Drop most of the references to Python 2.
- Switch anything that has been previously using Python 2.7 to Python
3.

MAR-154: Drop suppor for Python 2.7 from the wsgi_website role:

- Mostly a matter of dropping the Python version parameter, and
updating some package versioning to account for Python 3 only.

MAR-154: Drop support for Python 2.7 from the common role:

- This primarily concerns removal of pip requirements upgrade checks
for Python 2.7.
- The old Python 3-specific paths are getting deprecated, and the
Python 2 paths will be used instead.
- Set permissions on pipreqcheck directory explicitly (because of
deprecation testing).

MAR-191: Drop support for Debian 11 Buster from the wsgi_website role:

- Get rid of the workaround that used to cause issues in some of the
previous versions of Debian while at it. This should no longer pose
an issue.

MAR-191: Drop support for Debian 10 Buster from the php_website role:

- Move some of the distribution release-specific information used in
tests into a fixture of its own. Make the code a bit cleaner/more
consistent.

MAR-191: Drop support for Debian 10 Buster from the common role:

- Fix incorrect comment on the pkg-resources/pkg_resources package as
well - this one is not distro-dependent.

MAR-191: Drop Debian 10 Buster support for the backup_client role:

- Internal parameter for Python's pexpect package is no longer
required - newer versions of Debian have fully switche to using the
Python 3 version of it for duplicity.
- Fix prepare playbook task to iterate over list of backup users
instead of hard-coding the values.
- Drop the directory set-up task that seems to serve no purpose (some
leftover from previous refactoring most likely.
- Update supported version information in docs and metadata.

MAR-189: Added support for Debian 11 Bullseye to backup_server role:

- Drop the architecture version from the test machine names.

MAR-184: Update package versions for pip upgrade checks virtual environments:

- Should provide better test coverage compared to previously since
newer versions of pip-tools have slightly different ways of resolving
packages, as well as output formats.

MAR-182: Added ability to specify input requirements for running pip package upgrade checks against helper virtual environments:

- These environments are used for running the package upgrade checks
themselves.

MAR-181: Drop support for Debian 9 Stretch from php_website role:

- Keep the mail alias step - it is still relevant for Debian Buster.

MAR-181: Drop support for Debian 9 Stretch from web_server role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Drop Stretch-specific code and tests.

MAR-181: Drop support for Debian 9 Stretch from mail_server role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Use Debian Buster for helper machines.
- Drop Stretch-specific code and tests.

MAR-181: Drop support Debian 9 Stretch from mail_forwarder role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Use Debian Buster for helper machines.

MAR-181: Drop support for Debian 9 Stretch from ldap_server role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Drop the workaround for unsupported TLS ciphers on Debian Stretch.

MAR-181: Drop support for Debian 9 Stretch from database role:

- Bump VM memory to 512MB (otherwise MariaDB fails to start up).

MAR-165: Deploy Diffie-Helman parameters for LDAP server in the ldap_server role:

- Not relevant for Debian Strech because of a bug in the OpenLDAP
version it ships with.
- This should allow use of DHE ciphers with LDAP server.
- Generated DH parameters only help pick one of the parameters from
RFC-7919 (based on the size of generated ones).
- Make the cipher test lists distro-specific due to differences
between supported algorithms in respective GnuTLS versions.