According to the docs, this is frowned upon, as upgrading essential
packages might fail inside an unprivileged container.

That's a non-issue in our cases, as we're using privileged containers.

Further, we want to achieve the best of both worlds: we want to leverage
a build cache, to reduce build times, but, at the same time, we want to
pull in upgraded packages, in case the packages in question are already
installed.

This change should help with exposing errors like the one reported in
jvoisin/mat2#136 earlier in the future.

Relates jvoisin/mat2#136

Relates jvoisin/mat2#130

It seems, despite the name, both packages depend on Python 3. However,
pylint3 seems deprecated, and upstream recommends to install pylint:
https://www.pylint.org/#install

The current versions of both packages in Debian unstable are:
pylint  2.4.4-1
pylint3 2.2.2-1

This commit fixes failing CI jobs due to the use of pylint3 2.2.2-1,
which seems broken.

gentoo docker image is fixed upstream
see https://github.com/gentoo/gentoo-docker-images/issues/69

this might break again if the upstream gentoo/portage image gets fixed

This is required to add svg support to mat2

Thanks, @poncho!

Closes #1

Due to a regression, gdk-pixbuff is currently broken in testing.
Accordingly, use stable. At the same time, bubblewrap is only available
in testing, accordingly, pull it from there.

Thanks to Poncho for debugging!

Signed-off-by: georg <georg@riseup.net>

Relates #1