Change-Id: Ic8d070a6ec501de13bc6bb0eba7f80600a2e6137

Update the URL to the upper-constraints file to point to the redirect
rule on releases.openstack.org so that anyone working on this branch
will switch to the correct upper-constraints list automatically when
the requirements repository branches.

Until the requirements repository has as stable/2024.1 branch, tests will
continue to use the upper-constraints list on master.

Change-Id: Ib888d9caf247e7a435d28fd34b6ed0f8b19ed512

The PKCS#11 backend key-wraps (encrypts) the project-specific Key
Encryption Keys (pKEKs) using the master encryption key (MKEK).

The mechanism for wrapping/unwrapping the keys was hard-coded to use
CKM_AES_CBC_PAD.  This patch refactors the pkcs11 module to make this
mechanism configurable.

This is necessary to fix Bug #2036506 because some PKCS#11 devices and
software implementations no longer allow CKM_AES_CBC_PAD to be used for
key wrapping.

Supported key wrap mechanisms now include:

* CKM_AES_CBC_PAD
* CKM_AES_KEY_WRAP_PAD
* CKM_AES_KEY_WRAP_KWP

This patch also includes two additional patches so they can all be
tested at the same time:

Fix typo in wrap_key function

This patch fixes a typo in one of the mechanisms in the
PKCS11.wrap_key() function in the pkcs11 module.

and

Increase unit testing coverage for PKCS#11

This patch adds a few tests to increase the test coverage for the
PKCS#11 backend.

Closes-Bug: #2036506
Change-Id: Ic2009a2a55622bb707e884d6a960c044b2248f52
(cherry picked from commit 0d4101f)
(cherry picked from commit 7b36764)
(cherry picked from commit bae6737)
(cherry picked from commit b5841df)

NOTE(elod.illes): barbican-tox-py310-with-sqlalchemy-2x job is removed
in this patch to unblock the gate. This has been removed from 2024.2
onwards anyway. (The job is failing as there is no 'name' section in
setup.cfg in recent state of main branch)
Furthermore, barbican-dogtag-tox-functional job definition and usage is
removed as well, as zuul complains that the fedora nodeset [1] is
missing. To unblock the gate, this job has to be removed as well.

[1] 'The nodeset "devstack-single-node-fedora-latest" was not found.'

Change-Id: I9375c8ddcf9b40de6077a0b75e3d39927e61d58f
Signed-off-by: OpenStack Release Bot <infra-root@openstack.org>
Generated-By: openstack/project-config:roles/copy-release-tools-scripts/files/release-tools/functions