in systems with newer openssl, tls 1.0 has been disabled.
however, this breaks the ability of a client in a newer system to
connect with the openvpn servers on providers that are still on stretch.

platform needs to be upgraded.

-Related: leap/bitmask-vpn#105

-Resolves: #9378

when using snap, at least in qubes there's an error if we pick openvpn
from the system. if we're executing from a snap, we should pick the
snap's openpvn.

also disabling for now the ipv6 workaround, since it fails when
attempting to setup the i6 addr on the interface. --pull-filter should
work here, see https://community.openvpn.net/openvpn/ticket/849

Since we're blocking ipv6, it's nice to avoid resolving dual-stack sites
to ipv6, because many tools don't work otherwise.

- Resolves: #9027

Even if we don't recognize the state that openvpn is providing. Add
TCP_CONNECT state as well.

The tox environment is being generated by the *_test stages. And
it's cached and reused by the functional tests. The fact that both run
at the same time creates frequent glitches with vext.pyqt5 not being
present.Let's not share the cache between linux and mac, and let's be
sure that the cache is generated before the rest of the tests run.

- Resolves: #9313

the docker image provider bv snapcore/snapcraft is based on xenial, and
we need a special tag for the golang gtk3 libraries to be able to build
here.

-Closes: #9315

Some systems remove firewall rules, is usefull to be able to script the
reload of those rules in hooks or other custom systems.

- Resolves: #9289