Fixes #42719

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/libyaml/versions.

These checks were done:

- built on NixOS

- 0 of 0 passed binary check by having a zero exit code.
- 0 of 0 passed binary check by having the new version present in output.
- found 0.2.1 with grep in /nix/store/bn221ypclyhac7pzicwf0kj7b6g03d4v-libyaml-0.2.1
- directory tree listing: https://gist.github.com/a183f8e1406cfb340cfc7e4809746583
- du listing: https://gist.github.com/6731d94c1363109427d6793cc7cd010a

Don't know that there's a reason to keep the patch level
fixed at 0, optimistically bumping to latest (6).

https://github.com/libgit2/libgit2/releases/tag/v0.27.4

This commit rebuilds texlive 2017 with the final release of 2017. As described
in these issues [1][2][3], the upstream CTAN mirrors are a continuously moving
rolling release without historical archives.

This particular FTP server is also a rolling release folling CTAN for the latest
version, but it has snapshots of the final texlive releases; it appears that the
2017 distribution has been unmodified since texlive-2018 was released earlier
this year.

Along the way, we needed to fix several issues:
- xindy: if $HOME is unset, it will try to mkdir /homeless-shelter, which fails
  due to insufficient permissions.
- scheme-infraonly: this scheme had symlinks into other releases that were
  read-only, so it couldn't patch and modify the scripts. This commit removes it
  for now, but that's not a particularly satisfying solution. Ideas?

This also adds some documentation on the upgrade process to prepare for
texlive-2018 [4].

This commit also replaces the sha1 hashes with upstream's standard sha512 hashes.
It appears the motivation for the shorter hashes was to save disk space in the
derivations; in master, the size of this directory is 1012K; in this commit it
is 1600K. The difference is not particularly large, and the downsides to using
our own sha1 hashes are:

- More nix code to maintain
- Multi-step upgrade process for maintainers: the maintainer first has to
  download all upstream tarballs by sha512 hash, then run the fix script, then
  rebuild with sha1 hashes.
- Less transparent. If we use the upstream sha512 hashes, any user can
  immediately verify that the hashes we're providing match upstream, or match
  the snapshot in time.
- Easier to debug. Since upstream is rolling and packages may disappear or fail
  to build, it's useful to be able to determine if the sha mismatch is because
  of an update or not; if we have a sha1 mismatch and no tarball to pull, we
  can't figure out which sha512sum would have produced that sha1.
- Less trust required. Due to the above, users don't have to trust the
  content-addressed mirrors on IPFS and @veprbl's servers as much.
- Easier to cobble together a source distribution from a variety of sources. It
  seems some FTP servers have more/less than others, or older/newer packages. If
  we know what we're looking for beforehand and we're just missing a few
  packages whose hashes match the advertised hashes upstream, it's easier to find.

[1] #24683
[2] #10026
[3] #34490
[4] #40232

2.10 is the appropriate version for latest texlive 2017.

ncurses: patch wrong st-0.7 terminfo

This reverts commit 0f57d85, reversing
changes made to 65af430.

I'm missing human time to solve errors or verify that they're harmless...

There are security fixes for a few packages (and other changes).

Hydra: ?compare=1474536

b1548ce dropped the C compiler prefix

38eea80 dropped the C and C++ compiler prefixes. Probably more work is needed to make cross work, but this at least helps preserve/establish the pattern.

sometimes we want the "SDK" version from xcbuild so we do something
like:

$ xcbuild -version -sdk MacOSX10.10
SDKSettings.plist - MacOSX10.10 (MacOSX10.10)
SDKVersion: 10.10
Path: /nix/store/6k7crm1n4drf09ga0dwvbmb59x4zl2i2-SDKs/MacOSX10.10.sdk
PlatformPath: /nix/store/vhfwb1znfy65s2xs27j8xribk6mp6lbw-Platforms/MacOSX.platform
ProductName: Mac OS X
ProductVersion: 10.10

This was previously overriden by the current xcode version so you
would get:

Xcode 9.4.1
Build version 17E189

This should fix the other usage of -version in nodejs 6.x.

Some packages just can't handle them #44767.  It was tempting to try
to abstract this in some way, but I didn't do that ATM.

... to fix build; vcunat included the old ESR firefox, too.