www/varnish4: update to 4.1.0

[feld]

Summary

Varnish update to 4.1.0

Disruptive changes: new "jail" feature. Upstream wants Varnish to run as
its own user. We were previously running as www:www which is probably
not appropriate. I am creating a varnish user/group instead.

Users may have to blow away /usr/local/varnish/hostname before firing
varnishd back up.

TODO: write an UPDATING entry

https://github.com/varnish/Varnish-Cache/blob/varnish-4.1.0/doc/sphinx/whats-new/changes.rst

[mat]

Does it use the group at all ? I see no mention of it in the rc file.

[feld]

In D3878#80519, @mat wrote:

Does it use the group at all ? I see no mention of it in the rc file.

I had a chat with phk and he said we should have two users: varnish and vcache, both should be in the varnish group.

[feld]

Make varnishlog and varnishncsa run as non-root as well

[feld]

Give varnishncsa and varnishlog their own UIDs. Their membership into
the varnish group allow them to read logs, but will not permit them to
attack the running varnish process if they were somehow compromised.

[feld]

Reviewed Debian's approach and they share "varnishlog" user between the
varnishlog and varnishncsa processes