Updates third-party software in packages/

[tjkirch]

This gets a number of security and bug-fix updates. No major updates; still on Kubernetes 0.14, Docker 18.09.

Notes:

• Added missing Cargo.toml dependency on libseccomp from chrony.
• iptables patch 0002 was upstreamed.
• systemd patches 0001-0003 were upstreamed.
• libnetfilter_queue moved internal.h to "noinst" so we no longer have to remove it.
• Had to include a couple upstream patches from libseccomp to fix builds after 2.4.2.
• I didn't update cri-tools - we don't use it directly (maybe it's shelled out to?) and the release notes aren't clear about compatibility.
• The docker-proxy (libnetwork) commit is the latest from the branch we're on, the bump_18.09 backports branch.
• wicked is still blocked on wicked: update to 0.6.57+ #288.
• ncurses has date-level updates available, but seemingly nothing critical or for security; our patches don't apply, the files they apply to have changed quite a bit, and I don't understand the purpose of the patches, so I left it alone.

---

Testing done:

Scanned through all package build logs, even unchanged packages, and didn't see anything that scared me off; just the normal gcc warnings, particularly in bash and readline.

Built an aws-k8s AMI, it connected to my cluster and ran a pod OK, systemctl status running, and I was able to explore using the admin container and find nothing weird. kubelet logs look the same as before.

Built an aws-dev AMI, it ran a Docker container OK, systemctl status running, and I was able to explore using the admin container and find nothing weird.

[tjkirch]

Looks like CI is failing because it's more strict about setting capabilities, and libcap added its first test, which segfaults in the strict CI environment. The test is run during make install, which shouldn't happen, so I'm going to patch that out.

[iliana]

Changes look OK to me pending the libcap patch.

[tjkirch]

Added libcap patch; libcap still builds OK, no longer tests during install.

[bcressey]

In the future let's do one commit per package update, so that it's easier to revert one (if needed) and to follow the update history of a specific package.