adjust home dir permissions for service users correctly when machines see a
different UID at a later time. Ownership is now set for the (service) user
name, not the UID (PL-131881).
fc-userscan/garbage collect: ignore all dirs starting with nixpkgs because
scanning them takes a long time and yields false positives. In addition to
that, pkgs/test/make-binary-wrapper from nixpkgs is ignored explicitly
because it crashes userscan at the moment (PL-131439).
k3s/kubernetes: implement clean automated maintenance. Agent nodes are
drained (pods move to other nodes if possible) before executing maintenance
requests and are uncordoned after maintenance is finished. Only one agent
node can be in maintenance at any given time (PL-131525).
mailman: restart service on failure (PL-131783).
percona80: 8.0.32-24 -> 8.0.34-26 (PL-131639)
Pull upstream NixOS changes, security fixes and package updates (PL-131920):
chromedriver: 118.0.5993.70 -> 119.0.6045.105
chromium: 118.0.5993.117 -> 119.0.6045.105
element-web: 1.1.46 -> 1.1.47
gitlab-container-registry: 3.84.0 -> 3.85.0
gitlab: 16.4.1 -> 16.5.1
libtiff: patch for CVE-2023-41175 & CVE-2023-40745