The submodule was on 7.65.3 version. This update closes two security
problems:

https://curl.haxx.se/docs/CVE-2019-5482.html
https://curl.haxx.se/docs/CVE-2019-5481.html

See also curl-7.66.0 release notes:

https://curl.haxx.se/changes.html#7_66_0

Fixes #4502.

Found that the curl failed to build on FreeBSD with errors:
gmake[2]: Entering directory '/home/vagrant/tarantool/third_party/curl/src'
  CCLD     curl
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `SSLv23_client_method'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `CONF_modules_free'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `ERR_free_strings'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `sk_value'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `ENGINE_cleanup'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `SSL_library_init'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `EVP_MD_CTX_destroy'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `sk_pop_free'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `SSLeay'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `SSL_get_ex_new_index'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `OPENSSL_add_all_algorithms_noconf'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `SSL_COMP_free_compression_methods'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `EVP_MD_CTX_create'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `EVP_cleanup'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `sk_num'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `sk_pop'
/usr/local/bin/ld: ../lib/.libs/libcurl.so: undefined reference to `SSL_load_error_strings'
collect2: error: ld returned 1 exit status
gmake[2]: *** [Makefile:921: curl] Error 1

Found root cause of the issue at the `./configure <...>` output:
 | checking for OpenSSL headers version... 1.0.2 - 0x1000214fL
 | checking for OpenSSL library version... 1.1.1
 | configure: WARNING: OpenSSL headers and library versions do not match.
It is seen that the Tarantool bootstrap installed pkg 'openssl'
of the version '1.0.2', while the currently default FreeBSD 'openssl'
version was '1.1.1'.

Anyway we don't need any special openssl version installed against
default one, so the fix is just to remove the openssl package from
bootstrap installation.
Also found that some installing packages are not needed too,
removed it from FreeBSD bootstrap.

Additionally added libiconv library into bootstrap which is needed
as workaround to avoid of the issue described in:
	https://github.com/tarantool/tarantool/issues/3791

Closed #4490

It was forgotten to set MEM_Real flag for VDBE memory containing result
of varbinary to number cast operation. This patch fixes that and sets
corresponding flag if the cast takes place.

Closes #4356

Print the data type instead of the data itself in diag_set() in the case
of binary data. The reason of this patch is that LibYAML converts whole
error message to base64 in the case of non-printable symbols.

Part of #4356

Function do_op_insert() was depending on struct tuple_update
because of 'region' field. In next patches struct tuple_update
will be on much more high level of API than do_op_insert and such
a dependency would be wrong. Drop it.

Functions update_read_ops(), update_finish(),
tuple_upsert_squash() were depending on update_alloc() function
intended to be used by rope only. Rope will migrate down to lower
API in next patches, so this dependency should not exist.

Part of #1261

Splice was the last operation which used index_base in its do_op()
function. Now none of the operations use it. This allows to drop
dependency of operation implementations on index_base and on the
whole tuple_update, in next patches.

Part of #1261

- Unify error code names, they all should start with ER_UPDATE_*;

- Use string field identifier in error messages, because soon they
  will support both field numbers and JSON paths;

- Report all field numbers 1-based. This simplifies error analysis
  because no need to think from where an update has come - Lua or
  C/iproto. Also it allows to drop index_base argument from many
  functions;

- Introduce helper functions to set commonly appearing errors.
  Currently it is not a problem, but next patches will add several
  new files in all of which the same errors can happen;

- Deletion checks that number of fields to delete is > 0 right
  after reading the argument, not during deletion appliance. It
  allows to make such check in only one place even when more
  delete implementations will appear;

- make_arith_operation now takes update_op as an argument
  explicitly, not teared into separate arguments. It allows to use
  error helpers. Also dead code is dropped from this function with
  incorrect usage of some of errors;

Part of #1261

They are needed in JSON path update for a case, when a final part
of the path may not exist, and go_to_path returns an error.

That case is '=' and '!' on not existing fields. For example,
in {'=', '[1][2][3]', 20} field [3] can be not existing.

For these cases JSON update will have its own implementation of
go_to_path allowing optional last field.

Needed for #1261

Since ARRAY and MAP cannot be converted to SCALAR type, this
operation should throw an error. But when the error is raised in
SQL, it is displayed in unreadable form. The reason for this is
that the given array or map is not correctly converted to a
string. This patch fixes the problem by converting ARRAY or MAP to
their string representation.
For example:

box.execute('CREATE TABLE t1(i INT PRIMARY KEY, a SCALAR);')
format = {}
format[1] = {type = 'integer', name = 'I'}
format[2] = {type = 'array', name = 'A'}
s = box.schema.space.create('T2', {format=format})
i = s:create_index('ii')
s:insert({1, {1,2,3}})
box.execute('INSERT INTO t1 SELECT * FROM t2;')

Should return:
- error: 'Type mismatch: can not convert [1, 2, 3] to scalar'

Follow-up #4189

Function mem_apply_type() implements implicit type conversion. As
a rule, tuple to be inserted to the space is exposed to this
conversion which is invoked during execution of OP_MakeRecord
opcode (which in turn forms tuple). This function was not adjusted
to operate on ARRAY, MAP and ANY field types since they are poorly
supported in current SQL implementation. Hence, when tuple to be
inserted in space having mentioned field types reaches this
function, it results in error. Note that we can't set ARRAY or MAP
types in SQL, but such situation may appear during UPDATE
operation on space created via Lua interface. This problem is
solved by extending implicit type conversions with obvious casts:
array field can be casted to array, map to map and any to any.

Closes #4189

Method fio.mktree is used to create given path unconditionally -
without checking if it was a directory or something else. This
led to inappropriate error messages or even inconsistent behavior.
Now check the type of a given path.

Closes #4439

Allow views to use CTEs, which can be in any (nested) select after
<AS>. Before this patch, during view creation all referenced
spaces were fetched by name from SELECT and their reference
counters were incremented to avoid dangling references. It
occurred in update_view_references(). Obviously, CTE tables
weren't held in space cache, ergo error "space doesn’t exist" was
raised. Add check if a space from FROM is CTE. If it is, don't
increment its reference counter and don't raise the error.

Closes #4149

If the rock was packed with luarocks then the time in it is set to zeros
and this is not the case with the unix format can be removed when date given
is added to zipwriter_open_new_file_in_zip (luarocks/luarocks#1056)

Closes #4481

It was forgotten to swap old and new mask (holding fields involved into
foreign key relation) during space alteration (lists of object
representing FK metadata are swapped successfully). Since mask is vital
and depending on its value different byte-codes implementing SQL query
can be produced, this mistake resulted in assertion fault in debug build
and wrong constraint check in release build. Let's fix this bug and swap
masks as well as foreign key lists.

Closes #4495

ENGINE became reserved keyword in 1013a744. There's no any actual
reason why ENGINE should be reserved keyword. What is more, we are going
to use this word as a name of some fields for tables forming
informational schema. Hence, until it is too late (it is not documented
yet), let's remove ENGINE from the list of reserved keywords and allow
identifiers be that word.

Historically, we join a new replica off the last checkpoint. As a
result, we must always keep the last memtx snapshot and all vinyl data
files corresponding to it. Actually, there's no need to use the last
checkpoint for joining a replica. Instead we can use the current read
view as both memtx and vinyl support it. This should speed up the
process of joining a new replica, because we don't need to replay all
xlogs written after the last checkpoint, only those that are accumulated
while we are relaying the current read view. This should also allow us
to avoid creating a snapshot file on bootstrap, because the only reason
why we need it is allowing joining replicas. Besides, this is a step
towards decoupling the vinyl metadata log from checkpointing in
particular and from xlogs in general.

Closes #1271

This commit does not change a user visible behaviour. It refactors pwd
module to explicitly divide code that fetches data from passwd / group
databases from code that performs deserialization of the data to Lua
tables.

The idea of splitting of those actions appears when it was observed that
a call of getpw() / getgr() leads to problems on some systems when it is
invoked during passwd / group database traveral.

Now it is more obvious that we don't call getpw() during passwd
traversal and getgr() during group traveral.

Follows up #4428 and #4447.

Aside of that fixed other badges URLs to point to master branch.

(cherry picked from commit 7965aaaa88e6eaf266d2e51776598ac05a4a6cde)

LTO build fails on warning message:
In file included from /tarantool/src/lib/core/diag.h:33:0,
                 from /tarantool/src/box/engine.h:36,
                 from /tarantool/src/box/memtx_engine.h:40,
                 from /tarantool/src/box/memtx_engine.c:31:
/tarantool/src/box/memtx_engine.c: In function
'metmx_tuple_chunk_delete':
/tarantool/src/trivia/util.h:201:49: error: initialization from
incompatible pointer type [-Werror]
  const typeof( ((type *)0)->member  ) *__mptr = (ptr); \
                                                 ^
/tarantool/src/box/memtx_engine.c:1115:3: note: in expansion of macro
'container_of'
   container_of((typeof(tuple_chunk->data) *)data,
   ^
/tarantool/src/trivia/util.h:201:49: error: (near initialization for
'tuple_chunk') [-Werror]
  const typeof( ((type *)0)->member  ) *__mptr = (ptr); \
                                                 ^
/tarantool/src/box/memtx_engine.c:1115:3: note: in expansion of macro
'container_of'
   container_of((typeof(tuple_chunk->data) *)data,

Closes #4438

This patch provides a test suite that allows us to make sure that
the SQL BOOLEAN type works as intended.

Part of #4228

In a configuration with several read-only and read-write instances, if
replication_connect_quorum is not greater than the amount of read-only
instances and replication_connect_timeout happens to be small enough
for some read-only instances to form a quorum and exceed the timeout
before any of the read-write instaces start, all these read-only
instances will choose themselves a read-only bootstrap leader.
This 'leader' will successfully bootstrap itself, but will fail to
register any of the other instances in _cluster table, since it isn't
writeable. As a result, some of the read-only instances will just die
unable to bootstrap from a read-only bootstrap leader, and when the
read-write instances are finally up, they'll see a single read-only
instance which managed to bootstrap itself and now gets a
REPLICASET_UUID_MISMATCH error, since no read-write instance will
choose it as bootstrap leader, and will rather bootstrap from one of
its read-write mates.

The described situation is clearly not what user has hoped for, so
throw an error, when a read-only instance tries to initiate the
bootstrap. The error will give the user a cue that he should increase
replication_connect_timeout.

Closes #4321

@TarantoolBot document
Title: replication: forbid to bootstrap read-only masters.

It is no longer possible to bootstrap a read-only instance in an emply
data directory as a master. You will see the following error trying to
do so:
```
ER_BOOTSTRAP_READONLY: Trying to bootstrap a local read-only instance as master
```
Now if you have a fresh instance, which has
`read_only=true` in an initial `box.cfg` call, you need to set up
replication from an instance which is either read-write, or has your
local instance's uuid in its `_cluster` table.

In case you have multiple read-only and read-write instances with
replication set up, and you still see the aforementioned error message,
this means that none of your read-write instances managed to start
listening on their port before read_only instances have exceeded the
`replication_connect_timeout`. In this case you should raise
`replication_connect_timeout` to a greater value.

* All test chunks related to luajit were moved from tarantool source
tree to the luajit repo
* Adjusted CMakeLists via creating a symlink to luajit test directory
to fix out-of-source tests

Closed #4478

rows_per_wal does not allow to properly limit size of WAL logs.
A user would need to estimate size of each WAL row to do that.
Now WAL supports option wal_max_size allowing to limit WAL size
much more precise.

Part of #3762

The json.encode() used to cause a segfault in case of recursive
table:
  tbl = {}
  tbl[1] = tbl
  json.encode(tbl)

Library doesn't test whether given object on Lua stack parsed
earlier, because it performs a lightweight in-depth traverse
of Lua stack. However it must stop when encode_max_depth is
reached (by design).

Tarantool's lua_cjson implementation has a bug introduced during
porting original library: it doesn't handle some corner cases:
entering into a map correctly increases a current depth, while
entering into an array didn't. This patch adopts author's
approach to check encode_max_depth limit. Thanks to handling this
constraint correctly the segfault no longer occurs.

Closes #4366

Added support for the following curl options:
* CURLOPT_PROXY
* CURLOPT_PROXYPORT
* CURLOPT_PROXYUSERPWD
* CURLOPT_NOPROXY

@TarantoolBot document
Title: httpc: proxy server options

Use 'proxy' option to specify the proxy server host or IP-address
(optionally may be prefixed with a scheme - e.g. http:// or https://).
'proxy_port' and 'proxy_user_pwd' options may be used to specify the
proxy port (443 for https proxy and 1080 for others by default) and
user credentials (format: [user name]:[password]) respectively.

If 'proxy' option is not set a value from the corresponding
environment variable will be used. Environment variable names are:
'http_proxy', 'https_proxy', 'ftp_proxy' etc. 'all_proxy' variable
is used if no protocol specific proxy was set.

Setting 'proxy' option to an empty string will explicitly disable the
use of a proxy, even if there is an environment variable set for it.

Set 'no_proxy' option to specify a comma separated list of hosts that
do not require a proxy to get reached, even if one is specified by
'proxy' option (or the corresponding environment variable). The only
wildcard available is a single * character, which matches all hosts,
and effectively disables the proxy. 'no_proxy' environment variable
will be used if this option is not set.

Setting 'no_proxy' option to an empty string will explicitly enable
the proxy for all host names, even if there is an environment variable
set for it.

See:
https://curl.haxx.se/libcurl/c/CURLOPT_PROXY.html
https://curl.haxx.se/libcurl/c/CURLOPT_PROXYPORT.html
https://curl.haxx.se/libcurl/c/CURLOPT_USERPWD.html
https://curl.haxx.se/libcurl/c/CURLOPT_NOPROXY.html

The test sql-tap/gh-3083-ephemeral-unref-tuples.test.lua took
too long runtime and failed to finish in timeout limit of 2
minutes when it runs near the end of the running queue:

No output during 120 seconds. Will abort after 120 seconds without output. List of workers not reporting the status:
- 012_sql-tap [sql-tap/gh-3083-ephemeral-unref-tuples.test.lua, vinyl] at var/012_sql-tap/gh-3083-ephemeral-unref-tuples.result:0
Test hung! Result content mismatch:
[File does not exists: sql-tap/gh-3083-ephemeral-unref-tuples.result]
[Main process] No output from workers. It seems that we hang. Send SIGKILL to workers; exiting...

Due to suggestion from Konstantin Osipov at gh-3845:
https://github.com/tarantool/tarantool/issues/3845#issue-385735959

The following tests:
  gh-3083-ephemeral-unref-tuples.test.lua
  gh-3332-tuple-format-leak.test.lua
where set to run only on memtx configuration.

Also the test:
  gh-3083-ephemeral-unref-tuples.test.lua
was removed from the test-run 'fragile' option flaky list.

Closed #4128

We know that madvise(MADV_DONTDUMP) is present
on linux based platforms only (macos doesn't
support it at all, freebsd requires MADV_NOCORE
or similar which is unsupported by now) thus
we should not print a warning on other systems
to not spam users.

Fixes #4464

Closes #2200
Closes #4113
Closes #2233

@TarantoolBot document
Title: The box.internal.sql_function_create is forbidden
Legacy mechanism box.internal.sql_function_create to make some
Lua function available in SQL is forbidden now.

To make some function available in SQL you need to use
box.schema.func.create() mechanism: you need to specify
1) function language and language-specific options(e.g. you
   are able to define a persistent Lua function)
2) whether this function is_deterministic or not: deterministic
   functions allows to generate more efficient SQL VDBE bytecode
   so you better specify it when it is true
3) the function returns type: a Tarantool type string describes
   a type of value returned by function
4) param_list - a table of Tarantool's types strings desccribe
   function argument types
5) exports - a table of Tarantool's frontends where this function
   should be available ('LUA' by default). You need to specify
   {'LUA', 'SQL'} to make function available both in SQL requests
   and visible in box.func folder

Example:
-- Case1: C function
-- function1.so has int divide() symbol
box.schema.func.create("function1.divide", {language = 'C',
			returns = 'number',
			param_list = {'number', 'number'},
			is_deterministic = true,
			exports = {'LUA', 'SQL'}})
box.execute('SELECT "function1.divide"(6, 3)')
- metadata:
  - name: '"function1.divide"(6, 3)'
    type: number
  rows:
  - [2]
box.schema.func.drop("function1.divide")

-- Case2: Persistent Lua function
box.schema.func.create("SUMMARIZE", {language = 'LUA',
			returns = 'number',
			body = 'function (a, b) return a + b end',
			param_list = {'number', 'number'},
			is_deterministic = true,
			exports = {'LUA', 'SQL'}})
box.execute('SELECT summarize(1, 2)')
- metadata:
  - name: summarize(1, 2)
    type: number
  rows:
  - [3]
box.schema.func.drop("summarize")

Moreover there is a special predefined Lua function LUA that
allows to evaluate a custom Lua expressions in SQL.
You need to pass a string in form "return ...." to LUA function
that returns more than one value of any type.

Example:
box.execute('SELECT lua(\'return 1 + 1\')')
- metadata:
  - name: lua('return 1 + 1')
    type: any
  rows:
  - [2]
box.execute('SELECT lua(\'return box.cfg.memtx_memory\')')
- metadata:
  - name: lua('return box.cfg.memtx_memory')
    type: any
  rows:
  - [268435456]

Now it is possible to move all SQL builtin functions to
Tarantool's function hash. An existent FuncDef function
representation was replaced with func_sql_builtin class.
It has a sql-specific method :call and :finalize, while
port API call is not supported and protected with stubs.

This patch removes FuncDef hash and sql_function_create endpoint,
but doesn't introduce something instead. Therefore few affected
tests are disabled. A required functionality would be fixed in
the next patch.

Following tests using sql_create_function are broken now.
They are going to be fixed in the next commit:
 sql-tap/alias.test.lua sql-tap/check.test.lua
 sql-tap/func5.test.lua sql-tap/lua_sql.test.lua
 sql-tap/subquery.test.lua sql-tap/trigger9.test.lua
 sql/errinj.result sql/errinj.test.lua
 sql/func-recreate.test.lua

Part of #2200, #4113, #2233

@TarantoolBot document
Title: SQL builtins priveleges

All SQL built-ins are executed on SQL privilege level that is
undefined yet.

Now all SQL builtins are unique, i.e. each function has the only
hash table entry. This technique requires to remove static argc
checks for some builtins(substr, round, like, trim, count,
group_concat). Now they raise a runtime error in case of invalid
usage.

Updated error messages correspondingly, to provide more
informative messages in such cases. Taking into account upcoming
changes, all built-in functions names are uppercased.

Needed for #2200, #4113, #2233

Replaced sql function flag SQL_FUNC_MINMAX with couple new flags
SQL_FUNC_MIN and SQL_FUNC_MAX. This allows to distinguish MIN and
MAX function by flag instead of using user_data context.

This allows to delete user_data field in FundDef object in
further refactoring.

Needed for #2200, #4113, #2233

Changed sql_vdbe_mem_alloc_region routine name to the
vdbe_mem_alloc_blob_region because we are going to introduce
a new function with a really similar (but more appropriate) name
vdbemem_alloc_on_region in following patch. Due to the fact that
the function used only in vdbe.c module it has been moved there
and has been marked as "static".

Needed for #2200, #4113, #2233

Before a46b5200 SQL implementation featured min()/max() functions
overloading: if one argument was passed, then aggregate version would be
invoked; otherwise - scalar one. We decided to get rid of it and rename
scalar version to LEAST()/GREATEST() correspondingly. However, assertion
inside their implementations has been remained: it verifies that number
of passed arguments is greater than 1. On the other hand, now one can
pass literally any number of arguments to this function, including one
(which results in fired mentioned assertion) and zero (which leads to
NULL dereference in expr.c: these functions are marked with
SQL_FUNC_NEEDCOLL flag, and as a consequence they are assumed to have at
least one argument). Firstly, let's place check that number of passed
arguments more than one. Secondly, let's not assume that functions with
SQL_FUNC_NEEDCOLL must have any arguments.

Closes #4453

Added "fragile" option to the flaky tests that are
not intended to be run in parallel with others.
Option set at the suite.ini file at the appropriate
suites with comments including the issue that stores
the fail.

Removed the jobs that is interesting to check on gitlab-ci
instead of travis-ci:
  - osx 13 "Sierra"
  - all LTO jobs
  - ASAN job

Part of #4410

This is a followup for 7691154a

In case of throwing client error because of inactive function
we did not destroy used port. It could possibly cause huge
memory leaks as could be seen with top or its analogues when
performing net.box test run in a loop.

Closes #4388

It turned out that patch d0e38d59 wasn't accompanied
w/ a test. Add proper check.

Currently we only enter orphan mode when instance fails to connect to
replication_connect_quorum remote instances during local recovery.
On bootstrap and manual replication configuration change an error is
thrown. We better enter orphan mode on manual config change, and leave
it only in case we managed to sync with replication_connect_quorum
instances.

Closes #4424

@TarantoolBot document
Title: document reaction on error in replication configuration change.

Now when issuing `box.cfg{replication={uri1, uri2, ...}}` and failing to
sync with replication_connect_quorum remote instances, the server will
throw an error, if it is bootstrapping, and just set its state to orphan
in all other cases (recovering from existing xlog/snap files or manually
changing box.cfg.replication on the fly). To leave orphan mode, you may
wait until the server manages to sync with replication_connect_quorum
instances.
In order to leave orphan mode you need to make the server sync with
enough instances. To do so, you may either:
1) set replication_connect_quorum to a lower value
2) reset box.cfg.replication to exclude instances that cannot
   be reached or synced with
3) just set box.cfg.replication to "" (empty string)