Security fixes

• Upgrade Tor Browser to 9.0.5-build2 (Closes: #17469).

• Update Linux kernel to linux-image-5.4.0-3-amd64, currently at
  5.4.13-1 (Closes: #17443).

• Upgrade Thunderbird to 1:68.4.1-1~deb10u1

• Upgrade WebKitGTK to 2.26.3-1~deb10u1 (DSA-4610).

• Bugfixes

• live-persist: don't backup empty configuration files (Closes:

  17112). In some cases, the previous code would overwrite a

  non-empty backup file with an empty one, making it harder to
  recover from the already painful #10976.

• create-usb-image-from-iso: Run syslinux within proper chroot
  (Closes: #17179). Previously we ran syslinux from the host,
  which can lead to bugs if its versions differs from the one
  inside the chroot (which is what Zero Trace Pen will use later). Thanks
  to Johan Blåbäck for the patch!

• Zero Trace Pen Upgrader: Fix progress bar not pulsating and hide useless
  OK button (Closes: #16603).

• Minor improvements and updates

• Upgrade tor to 0.4.2.6 (Closes: #17059).

• Install the trezor package, which adds a command-line (only)
  tool for managing Trezor devices (Closes: #17463). Thanks to
  Pavol Rusnak for the patch!

• As a consequence of the Linux kernel upgrade we also:

  • Upgrade aufs to 5.4.3 20200127.
  • Install VirtualBox guest tools and kernel modules from sid.

• Build system

• Upgrade snapshot of the Debian archive to 2020020302, including
  the 10.3 point release of Debian Buster (Closes: #17458).

• Add opt-in caching of the wiki (Closes: #15342).

• Use mksquashfs' -no-exports option even when the fastcomp build
  option is set. "fastcomp" is supposed to only tweak SquashFS
  compression settings, but so far it was also disabling the
  -no-exports option that we set for our release builds.

• Drop a bunch of packages installed for ikiwiki for various
  (obsoloete) resons:

  • libfile-chdir-perl, libyaml-perl and libxml-simple-perl which
    was needed back when we built our own ikiwiki from Git… a
    looong time ago.
  • libtext-multimarkdown-perl used multimarkdown ikiwiki which
    its doubtful we ever will use.
  • libhtml-scrubber-perl, libhtml-template-perl,
    libhtml-parser-perl, libyaml-libyaml-perl and liburi-perl
    which are already installed as ikiwiki dependencies.

• Install libimage-magick-perl instead of the perlmagick
  transitional package.

• Don't install obsolete dependencies whois and eatmydata.

• Consistently validate individual build options as we parse them.
  This is consistent with how we handled "fastcomp" already. Only
  compatibility checks between multiple build options really need
  to happen later, once we've parsed all build options.

• Remove 5 years old transition code

• Fully provision the Vagrant box every time it starts, and
  partially re-provision it for every build.

• Behave correctly when disabling a previously set "offline" or
  "vmproxy+extproxy" build option. Previously, setting one of
  these build options once would taint the Vagrant box forever
  with the resulting apt-cacher-ng configuration.

• Shrink the apt-cacher-ng cache after a successful build too
  (Closes: #17288).

• Set up infrastructure to retrieve log file from the VM even on
  build failure (Closes: #7749).

• Always build from a fresh Git clone.

• Set the permissions that Vagrant needs inside the source tree
  (Closes: #11411, #16607, #17289).

• Test suite

• Remove Seahorse key synchronization scenarios. These 2 scenarios
  never pass due to #17169, so currently:

  • They don't teach us anything new → no benefit.
  • Every time a developer looks at test suite results,
    they need to filter out this known problem, which takes time
    and trains us to ignore problems.