(cherry picked from commit 9e0c8f0)
I think it's better to reflect the status quo in 19.09 as well.

melpa-packages: 2020-01-08

[19.09] bind: 9.14.8 -> 9.14.9

We should wait until after `multi-user.target` is triggered to allow
hardware to finish initializing, such as network devices and USB drives.
This ensures `powertop --auto-tune` sets more tunables to "Good".

Fixes NixOS#66820

The last release was in September, so it's surely "vulnerable" now.
https://www.mozilla.org/en-US/firefox/60.9.0/releasenotes/

This is the same appproach we've taken for esr-52.

(cherry picked from commit f703a3a)

`rustfmt` is now a compile time dependency because the varlink generated
code is formatted with it.

(cherry picked from commit c976dc1)

They both base on firefox versions where support has ended some time
ago. With CVE-2019-17026 (and other vulnerabilities) out and exploited
in the wild, these should not be used anymore. tor-browser-bundle-bin is
a better alternative.

[19.09] firefoxPackages.tor-browser*: mark as vulnerable

(cherry picked from commit 05c0695)

It's based on 60.3.0, whose support ended around October 2019.

(cherry picked from commit 0e75514)

[19.09] firefoxPackages.icecat: mark as insecure

lorri: unstable-2019-10-30 -> unstable-2020-01-09 (backport to release-19.09)

[19.09] nixos/pppd: init

(cherry picked from commit 174190d)

(cherry picked from commit 0d9600f)

Fixes NixOS#77266: CVE-2019-1551
https://www.openssl.org/news/secadv/20191206.txt

... into staging-19.09

This reverts commit 93aabab.
This reverts commit e915608.

Based on change in master at d1bd0fb
opened in NixOS#77442

[19.09] chromium: 78.0.3904.108 -> 79.0.3945.79

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop_17.html

CVE-2019-13767

https://www.thunderbird.net/en-US/thunderbird/68.4.1/releasenotes/
https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/

(cherry picked from commit a1d4878)
Re-tested both briefly on 19.09

These enable some power management settings. They are needed for [s-tui
to show power readings](amanusk/s-tui#105).

The values chosen here match what Arch Linux has. In particular
the Intel specific code is loadable as a module rather than compiled in.

(cherry picked from commit 299e6f0)

[19.09] kernel: set POWERCAP and INTEL_RAPL