upgrade runtime container from s6-base deb11 -> s6-overlay-lite deb12, openvpn from 2.5.1 -> 2.6.3

See merge request !8

 - runtime base image from s6-base(deb11) to s6-overlay-lite(deb12)
 - update kresd package repo url
 - openvpn from 2.5.1 -> 2.6.3

Remove shapeshifter from openvpn container

See merge request !6

We'll run obfs4 bridge processes in a separate obfsvpn container which
can be colocated with the openvpn gateway or hosted separately.

Additionally removes some out of date documentation.

Replace openvpn-exporter with textfile exporter.

See merge request !5

The upstream openvpn-exporter was emitting high cardinality metrics, because of
the CN being an unique identifier based off of the certificate. This would cause
the tsdb to fill with unnecessary, and unrelated metrics.

This removes that exporter (which has not seen commits for years) and replaces
it with the prometheus-node-exporter textfile collector, which will emit metrics
produced by the shell script that is run every 10 seconds. It will only emit
these metrics:

openvpn_server_connected_clients{status_path="/tmp/openvpn-status-tcp"}
openvpn_server_connected_clients{status_path="/tmp/openvpn-status-udp"}
openvpn_up{status_path="/tmp/openvpn-status-tcp"}
openvpn_up{status_path="/tmp/openvpn-status-udp"}

With this enabled, cardinality of the tsdb gets way too big.

If there is an unclean container termination (eg. OOM), the kresd cache files
can get corrupted (especially the lock.mdb). Additionally, there are issues with
PID namespacing that can cause the cache to not work
right (cf. https://gitlab.nic.cz/knot/knot-resolver/-/issues/637).

So to avoid these issues, we remove the cache on startup, and accept a
cold-cache init.

If we were to remove these on shutdown, they may not get removed if the
container terminates unclean.

The version in Debian is very old and has issues.

We revert to shapeshifter-dispatcher because obfsvpn is not working yet, and we
also do not need vpnwatch.

The udp service was not passing the same arguments as the tcp one, this fixes
the missing --syslog flag

iproute2 needs to be explicitly installed, the iptables alternative needs to
iptables-legacy.