Moderate: grafana security and enhancement update (Oracle Linux 8)

[9.2.10-7]
- resolve RHEL-12649
- resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work
- testing is turned off due to test failures caused by testing date mismatch

[9.2.10-6]
- Add /usr/share/grafana to systemd-sysusers --replace

[9.2.10-5]
- resolve CVE-2023-3128 grafana: account takeover possible when using Azure AD OAuth

[9.2.10-4]
- bumps exporter-toolkit to v0.7.3, sanitize-url@npm to 6.0.2, skip problematic s390 tests.

[9.2.10-3]
- Use systemd-sysusers --replace

[9.2.10-2]
- Use systemd-sysusers instead of sysusers_create_compat, which is not available in RHEL-8

[9.2.10-1]
- Update to 9.2.10

[7.5.15-4]
- resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in
- resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
- resolve CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
- resolve CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
- run integration tests in check phase
- update FIPS patch with latest changes in Go packaging

[7.5.15-3]
- resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
- resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
- resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
- resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
- resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
- resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
- resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
- resolve CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
- resolve CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal

[7.5.15-2]
- resolve CVE-2022-31107 grafana: OAuth account takeover

[7.5.15-1]
- update to 7.5.15 tagged upstream community sources, see CHANGELOG
- resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access some data sources
- resolve CVE-2022-21702 grafana: XSS vulnerability in data source handling
- resolve CVE-2022-21703 grafana: CSRF vulnerability can lead to privilege escalation
- resolve CVE-2022-21713 grafana: IDOR vulnerability can lead to information disclosure
- resolve CVE-2021-23648 sanitize-url: XSS
- resolve CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter
- declare Node.js dependencies of subpackages
- make vendor and webpack tarballs reproducible

[7.5.11-2]
- resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache
- resolve CVE-2021-43813 grafana: directory traversal vulnerability for *.md files

[7.5.11-1]
- update to 7.5.11 tagged upstream community sources, see CHANGELOG
- resolve CVE-2021-39226

[7.5.10-1]
- update to 7.5.10 tagged upstream community sources, see CHANGELOG

[7.5.9-3]
- rebuild to resolve CVE-2021-34558

[7.5.9-2]
- remove unused dependency property-information
- always include FIPS patch in SRPM

[7.5.9-1]
- update to 7.5.9 tagged upstream community sources, see CHANGELOG

[7.5.8-1]
- update to 7.5.8 tagged upstream community sources, see CHANGELOG
- remove unused dependencies selfsigned, http-signature and gofpdf

[7.5.7-2]
- remove unused cryptographic implementations
- use cryptographic functions from OpenSSL if FIPS mode is enabled

[7.5.7-1]
- update to 7.5.7 tagged upstream community sources, see CHANGELOG

[7.3.6-2]
- change working dir to in grafana-cli wrapper (fixes Red Hat BZ #1916083)
- add pcp-redis-datasource to allow_loading_unsigned_plugins config option

[7.3.6-1]
- update to 7.3.6 tagged upstream community sources, see CHANGELOG
- remove dependency on SAML (not supported in the open source version of Grafana)

[7.3.4-1]
- update to 7.3.4 tagged upstream community sources, see CHANGELOG
- bundle golang dependencies
- optionally bundle node.js dependencies and build and test frontend as part of the specfile
- merge all datasources into main grafana package
- change default provisioning path to /etc/grafana/provisioning
- resolve https://bugzilla.redhat.com/show_bug.cgi?id=1843170

[6.7.4-3]
- apply patch for CVE-2020-13430 also to sources, not only to compiled webpack

[6.7.4-2]
- security fix for CVE-2020-13430

[6.7.4-1]
- update to 6.7.4 tagged upstream community sources, see CHANGELOG
- security fix for CVE-2020-13379

[6.7.3-1]
- update to 6.7.3 tagged upstream community sources, see CHANGELOG
- add scripts to list Go dependencies and bundled npmjs dependencies
- set Grafana version in Grafana UI and grafana-cli --version
- declare README.md as documentation of datasource plugins
- create grafana.db on first installation (fixes RH BZ #1805472)
- change permissions of /var/lib/grafana to 750 (CVE-2020-12458)
- change permissions of /var/lib/grafana/grafana.db to 640 and
user/group grafana:grafana (CVE-2020-12458)
- change permissions of grafana.ini and ldap.toml to 640 (CVE-2020-12459)

[6.6.2-1]
- added patch0 to set the version string correctly
- removed patch 004-xerrors.patch, it's now upstream
- added several patches for golang vendored vrs build dep differences
- added patch to move grafana-cli binary to libexec dir
- update to 6.6.2 tagged upstream community sources, see CHANGELOG

[6.3.6-1]
- add weak depenency on grafana-pcp
- add patch to mute shellcheck SC1090 for grafana-cli
- update to 6.3.6 upstream community sources, see CHANGELOG

[6.3.5-1]
- drop uaparser patch now it's upstream
- add xerrors patch, see https://github.com/golang/go/issues/32246
- use vendor sources on rawhide until modules are fully supported
- update to latest upstream community sources, see CHANGELOG

[6.3.4-1]
- include fix for CVE-2019-15043
- add patch for uaparser on 32bit systems
- update to latest upstream community sources, see CHANGELOG

[6.2.5-1]
- update to latest upstream community s