test: fix D-Bus policy override for TEST-73-LOCALE

We don't need to allow non-root, and the policy needs to specify destination
and interface too, to narrow it down

Follow-up for 7b5c38a91def6cf236605010a0a93a1cd4c137e9

mkosi: update debian commit reference

* c7138e0b87 Configure default DNS servers for upstream CI builds
* bc5d1afe1e Drop out-of-tree localed patch and use D-Bus policy instead
* b5f8ababde autopkgtest: set Release= in mkosi.local.conf to distinguish testing vs unstable
* 323afafd80 autopkgtest: add allow-stderr to timedated test
* 0291f361e3 Install valrinkctl zsh completion file
* f40b9eba02 d/t/control: add Depends: lib{systemd,udev}-dev for upstream
* 3def595de3 d/t/upstream: ensure correct ubuntu codename is used
* 531bb6817e d/t/boot-and-services: fix a couple python sytax warnings
* 963ac13b7d d/t/boot-and-services: skip test_tmp_cleanup if tmp.mount is overridden

hwdb: add axis range corrections for the Lenovo Thinkpad E16

Merge pull request #33823 from YHNdnzj/varlink-deserialize-again

core: reliably check if varlink socket has been deserialized; switch varlink server to pidref

add udev rules for trezor hw wallet devices

resolved: report svc params as a json object

This representation is significantly more useful. The previous array
format omitted the svc param key, which is not very useful.

Merge pull request #33810 from YHNdnzj/find-executable-simplify

path-util: minor cleanup for find_executable()

Merge pull request #33809 from YHNdnzj/pidref-namespace

namespace-util: introduce pidref_namespace_open() and use it where appropriate; clean up mount-util a bit along the way

Merge pull request #33535 from neighbourhoodie/tests/dns-cache

Tests for DnsCache functions

Merge pull request #33534 from neighbourhoodie/tests/dns-query

Tests for DnsQuery functions

core-varlink: switch to PidRef + manager_get_unit_by_pidref()

core-varlink: do not log about ENOENT if oomd isn't available

This is simply too noisy, since every invocation of
manager_varlink_send_managed_oom_update() would try to
connect to oomd if not already.

core-varlink: add missing runtime_scope check for manager_varlink_init_user()

core: reliably check if varlink socket has been deserialized

Follow-up for 6906c028e83b77b35eaaf87b27d0fe5c6e1984b7

The mentioned commit uses access() to check if varlink socket
already exists in the filesystem, but that isn't sufficient.

> Varlink sockets are not serialized until v252, so upgrading from
> v251 or older means we will not listen anymore on the varlink sockets.
>
> See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074789
> for more details as this was found when updating from Debian Bullseye to a new version.

After this commit, the set up of varlink_server is effectively
split into two steps. manager_varlink_init_system(), which is
called after deserialization, would no longer skip listening
even if Manager.varlink_server is in place, but actually
check if we're listening on desired sockets.
Then, manager_deserialize() can be switched back to using
manager_setup_varlink_server().

Alternative to #33817

Co-authored-by: Luca Boccassi <bluca@debian.org>

mount-util: reorder params for mount_in_userspace, clean up logging

mount-util: do not unnecessarily acquire mountns fd twice

This also enables us to use pidref_namespace_open().

mount-util: clean up mount_exchange_graceful a bit, don't duplicate move_mount when fallback

machine-dbus: use pidref_namespace_open() where appropriate

namespace-util: introduce pidref_namespace_open()

namespace-util: explicitly specify namespace_info[]'s size

We do this already in all string lookup tables. This way
it's guaranteed that iterators which ends with _NAMESPACE_TYPE_MAX
wouldn't overrun the array.

path-util: simplify final path for find_executable()

Currently, systemd-run ./test.sh would set Description=
to $PWD/./test.sh. This is quite ugly.

path-util: trivial cleanup for find_executable_full()

core: clean up Set/LoadCredential= parsers

Make logging consistent, plus introduce helper function
for adding creds to ExecContext.set_credential too.

mkosi: Bump device timeout even more

I still manage to hit it in some cases so let's bump again.

Merge pull request #33533 from neighbourhoodie/tests/dns-synthesize

resolved: tests for dns_synthesize_family() and dns_synthesize_protocol()

resolved: tests for dns_synthesize_answer()

sd-dhcp-server: persist hardware addresses in leases

resolved: tests for dns_query_string()

resolved: tests for dns_query_go(); multiple search domains for dns_query_candidate_notify()

resolved: refactor environment management in dns_query_go() tests

resolved: tests for dns_query_go() when configured with search domains

resolved: tests for dns_query_go() when no scopes are available

resolved: tests for dns_query_go() using a bypass query

resolved: tests for dns_query_go() -- with and without network link

resolved: tests for dns_query_process_cname_one(); no match, DNAME, utf-8 handling

resolved: tests for dns_query_process_cname_many()

resolved: tests for common usage of dns_query_process_cname_one()

resolved: tests for dns_query_make_auxiliary()

resolved: tests for dns_query_new()

resolved: tests for dns_cache_lookup() clamping the TTL

resolved: tests for dns_cache_put() for  NXDOMAIN with no SOA

resolved: test that pseudo classes and types are not cached

resolves: tests for dns_cache_prune()

resolved: tests for dns_cache_check_conflicts()

resolved: tests for dns_cache_export_shared_to_packet()

resolved: tests for dns_cache_lookup(); mDNS and multiple matching entries

resolved: tests for dns_cache_lookup() returning the most recent input

resolved: tests for dns_cache_dump()

resolved: test cache misses

resolved: tests for dns_cache_lookup() for NXDOMAIN

resolved: first test for dns_cache_lookup()

resolved: tests for dns_cache_dump_to_json()

resolved: check that adding an expired response removes cache entry

resolved: tests for dns_cache_put(); CNAME success and name error

resolved: tests for dns_cache_put() with non-matching class, type, name

resolved: refactor DNS answer construction for cache tests

resolved: test for dns_cache_put() with empty answer

resolved: tests for dns_cache_put() with different RCODEs

resolved: tests for dns_cache_put(); successful A query

Co-Authored-By: jan@neighbourhood.ie

Merge pull request #33531 from neighbourhoodie/tests/dns-zone

resolved: tests for dns_zone_lookup()

resolved: tests for dns_zone_remove_rrs_by_key()

resolved: tests for dns_zone_remove_rr()

resolved: tests for dns_zone_put()

Merge pull request #33530 from neighbourhoodie/tests/dns-search-domain

resolved: tests for dns_search_domain_find()

resolved: tests for search domain marking and unlinking

resolved: extract function for checking search domains

resolved: tests for dns_search_domain_unlink()

resolved: tests for dns_search_domain_new()

Merge pull request #33529 from neighbourhoodie/tests/dns-link

Tests for DNS Link functions

Merge pull request #33528 from neighbourhoodie/tests/dns-answer

resolved: tests for dns_answer_order_by_scope()

resolved: tests for dns_answer_has_dname_for_cname()

resolved: tests for dns_answer_dump()

resolved: tests for dns_answer_{copy,move}_by_key()

resolved: tests for dns_answer_remove_by_answer_keys()

resolved: tests for dns_answer_remove_by_{key,rr}()

resolved: tests for dns_answer_merge() and dns_answer_extend()

resolved: tests for dns_answer_find_soa()

resolved: tests for dns_answer_add(), dns_answer_match_key()

Merge pull request #33526 from neighbourhoodie/tests/dns-question

resolved: tests for dns_question_merge()

resolved: tests for dns_question_first_name()

resolved: tests for dns_question_dump()

resolved: tests for dns_question_cname_redirect()

resolved: tests for dns_question_is_equal()

resolved: tests for dns_question_is_valid_for_query()

resolved: tests for dns_question_matches_cname_or_dname()

resolved: tests for dns_question_matches_rr()

resolved: tests for dns_question_new_service()

resolved: tests for dns_question_new_reverse()

resolved: tests for dns_question_new_address()

resolved: tests for dns_question_add()

Merge pull request #33525 from neighbourhoodie/tests/dns-rr

resolved: tests for dns_resource_record_source(), dns_resource_record_is_synthetic(), dns_resource_record_signer(), dns_resource_record_is_signer()

resolved: tests for dns_resource_record_to_wire_format()

Note this function does not produce compressed domain names in the RDATA
when serializing the RR.

resolved: tests for dns_resource_record_to_string()

resolved: tests for dns_resource_key_{to,from}_json()

This test doesn't check the generated JSON data in detail, it simply
tests that round-tripping an RR key through the JSON representation
preserves its data.