Fix-committed: #11971, #12348

Fix-committed: #12485

The former has been down for a while and it's not clear when it's going
to be stable again. The latter should be reliable.

These steps were renamed as part of #12362, but this feature was not updated
accordingly yet.

Fix-committed: #12570

It seems that they started being played since
commit:bbd006c3.

This reverts commit 1e8bec50.

For now, the @{pid} tunable matches all pids; see
/etc/apparmor.d/tunables/kernelvars for details. So it's not worth carrying
a delta vs. the upstream profile, even though this improvement makes sense:
better contribute it directly upstream.

refs: #12485, Debian#862993

Fix-committed: #11583

Fix-committed: #12362

Fix-committed: #12561

Apparently this new Firefox will get the realpath of the places.sqlite
symlink, get its parent directory and create places.sqlite-{shm,wal}
there -- if the creation of these two files fail, it's like if there
are no bookmarks, and no new ones can be added (the "Add bookmarks"
dialog won't even open). So we have to allow the creation of these
files too.

Unfortunately this is not enough. If the target file of the symlink
doesn't exist it is interpreted as a corrupt database => the symlink
is deleted and replaced with a fresh bookmarks database (inside the
Tor Browser profile, not the persistent directory). So, if you already
have persistent bookmarks from before it will work, but if enable it
for the first time it won't work. This will be fixed later, and will
be documented as a known issue in Tails 3.0~rc1.

refs: #12362

Refactor 80-block-network to avoid a function whose name ends with "filter" to modify the filtered lines (refs: #12362).

This reverts commit e4b9c58a.

The bug we were working around has been fixed in Tor 0.3.0.7, that
this branch installs.

... so they can be blacklisted without us having to manually maintain
this list.

Will-fix: #12362

We need to use a different subshell each time we cd into a different
directory using a relative path, otherwise only the first cd works.

Release process: fix command-line to update changelog when previous version number != previous version tag.