Addresses the following AVC denial:

type=PROCTITLE msg=audit(01/12/2023 02:58:12.648:696) : proctitle=/usr/sbin/vncsession fedora :1
type=PATH msg=audit(01/12/2023 02:58:12.648:696) : item=1 name=/home/fedora/.vnc nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(01/12/2023 02:58:12.648:696) : item=0 name=/home/fedora/ inode=262145 dev=fc:02 mode=dir,700 ouid=fedora ogid=fedora rdev=00:00 obj=unconfined_u:object_r:user_home_dir_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(01/12/2023 02:58:12.648:696) : cwd=/home/fedora
type=SYSCALL msg=audit(01/12/2023 02:58:12.648:696) : arch=x86_64 syscall=mkdir success=no exit=EACCES(Permission denied) a0=0x7fff47d52540 a1=0755 a2=0x0 a3=0x0 items=2 ppid=2869 pid=2880 auid=fedora uid=fedora gid=fedora euid=fedora suid=fedora fsuid=fedora egid=fedora sgid=fedora fsgid=fedora tty=(none) ses=8 comm=vncsession exe=/usr/sbin/vncsession subj=system_u:system_r:vnc_session_t:s0 key=(null)
type=AVC msg=audit(01/12/2023 02:58:12.648:696) : avc:  denied  { create } for  pid=2880 comm=vncsession name=.vnc scontext=system_u:system_r:vnc_session_t:s0 tcontext=system_u:object_r:vnc_home_t:s0 tclass=dir permissive=0

Resolves: rhbz#2143704
(cherry picked from commit 717d787de8)

Clipboard functions may run on connections that are not yet at
RFBSTATE_NORMAL. Due to recent hardening of the accessCheck() function,
it is important to validate that the state is RFBSTATE_NORMAL before
calling accessCheck().

Fixes #1599.

(cherry picked from commit 995f443ef7)

An assert will kill the entire server, which is overly harsh when there
is a problem with a single connection. Instead, throw an exception which
will just disconnect that specific client.

(cherry picked from commit 6b7a69e807)

(cherry picked from commit 75e6e8e35c)

Make sure we don't send a bogus request to the X server in the (common)
case that we don't actually have anything to restore.

(cherry picked from commit 1e3484f201)

(cherry picked from commit 4895f53aef)

(cherry picked from commit 4701b05b78)

(cherry picked from commit dd40ebee73)

(cherry picked from commit 09a533ac50)

(cherry picked from commit 3018f30ad3)

(cherry picked from commit 52bfe6dae8)

(cherry picked from commit e9b322de82)

(cherry picked from commit 115cc12a5a)

(cherry picked from commit 3a0e5cf124)

(cherry picked from commit 9e109a2873)

(cherry picked from commit 7cf6ca3cb4)

(cherry picked from commit e88f0634f2)

(cherry picked from commit b39c3d3f6a)

(cherry picked from commit 5a2ab94235)

It's just the name of the system, so there is nothing in that string to
translate.

This should be happening implicitly, but isn't always for some reason on
macOS 13.

The system steals keyboard events for certain system keyboard shortcuts,
e.g. Cmd+Tab. Unfortunately this isn't considered a focus loss, so we
don't realise we've lost a few keyboard events and can end up in a
confused state.

Fortunately it is possible to detect when this happens and reset the
keyboard state, just like we do when focus is lost.

Delay startup of VNC sessions until user databases are up and running.
This is the same ordering that GDM imposes to make sure users can
actually log in.

We might often fail to find a matching X11 keycode when the client has
a different keyboard layout and end up with no key event. To avoid a
failure we add it as a new keysym/keycode pair so the next time a keysym
from the client that is unknown to the server is send, we will find a
match and proceed with key event. This is same behavior used in Xvnc or
x11vnc, although Xvnc has more advanced mapping from keysym to keycode.

We don't want any stray exceptions as we are cleaning up, so handle any
still pending decoder errors by just logging them. We are already
shutting down so there is no need to abort the connection here.

They don't get access bits until they've been authenticated, so avoid
doing any checks on clients in those early states.

It probably wanted to say "newer", but let's say "later" instead. Other
building requirements say "later".

Avoid having to update this manually.

These require a key to have been set up on the server beforehand, so
they do not give a good default experience as clients will be unable to
connect.

This is missing in the CentOS 9 repositories for some reason. Download
it directly from the build system until this can be fixed.

The older versions are getting deprecated, so make the switch.

These files are checked in, so there is no need to build these for
packaging.

This is needed to correctly handle the spec file, so it needs to be
installed before we parse it for build dependencies.

We do all the prep work in the image step for the other targets, so
let's do the same here.

This is a build requirement, not a fundamental system thing, so it
should not be handled here.

The image has been updated, so this workaround is no longer needed.

Try to organise this better to make it clear which dependencies are
ours, and which we've gotten just because Xvnc is based on xorg-server.

Also update the dependency list to the current state of things.

This is what upstream does, so let's add it in case some dependency is
added implicitly by the Debian build tools somewhere.