Suggested by @gquintard.

We see linking failures sometimes, so hopefully that solves those.

Closes #3702

We grab the image from Red Hat's quay.io image repository, which is done
with the addition of an optional prefix parameter for distcheck jobs and
a hardcoded hack for packaging jobs.

To make this work, the aarch64 packaging jobs had to be generalized to
less specific "arm64" images.

But only fedora:latest has a packaging job.

Better diff with the --ignore-all-space option.

Presumably, to run images with fairly recent software?

Not all RPM-based distributions are EPEL consumers.

Better diff with the --ignore-all-space option.

Instead we can run packaging jobs directly from the target system's base
image.

The dist job is here to create a dist archive that serves as input for
packaging jobs. The distcheck jobs work directly from a git clone.

The fixed chunk size of one prevents testing the vxid cache behaviour.

in other words: Allow comments in the replay string

To match (pun intended) the naming convention in other places, keep
"match" for regular expressions matching.

Setting breakpoints in a debugger on select vsl events is tidious,
so add a simple facility to trigger abort() with a logexpect command.

Otherwise sanitizers suppressions may scroll the first expectation out.

Note to self: `process pNAME -winsz` is not documented.

TOSTRAND() creates a pointer with temporary lifetime which we must not
access outside of the expression where it is created.

Incidentally, this is what I had before a polish with good intentions,
which, as we all know, are not enough.

Noticed by Geoff, thank you

Ref ISO/IEC 9899:2018 §6.2.4 (8)
Ref 0c96fc65

Spotted by Coverity Scan.

Spotted by Coverity Scan.

Spotted by Coverity Scan: if we have a reservation, it must be the last
workspace allocation, so there must be one.

This plugs a leak spotted by Coverity Scan. It might be useful in other
places anyway, so it might as well be decoupled from constant regexp
parsing.

Refs #3776

Refs #3776

I somehow convinced myself that ${{ secrets.COVERITY_SCAN_TOKEN }} was
the default value.