This aligns further with the guix hash command behavior.

```
$ guix hash -S nar -f base32 -H sha256 -x /var/tmp/panda
apq7sedacxf2lqaebllbngtszci63v7cbwxmo4276k26nv4ocseq
$ python -m nar -f base32 -H sha256 /var/tmp/panda
apq7sedacxf2lqaebllbngtszci63v7cbwxmo4276k26nv4ocseq====
guix hash -S nar -f base32 -H sha256 -x /var/tmp/hgview
lepywr37sfg4uqmetcww2q2hxjicgags3xt5fjbvjoepiqcluj5q
$ python -m nar -f base32 -H sha256 /var/tmp/hgview
lepywr37sfg4uqmetcww2q2hxjicgags3xt5fjbvjoepiqcluj5q====
```

Related to T4538#93319

```
$ guix hash -S nar -f base32 -H sha256 -x guix-modules
bd4jxucj7hqpvjv5646rxehevbia6gnym7y4kebj4cm3eugdwpma
$ python -m nar -f base32 -H sha256 guix-modules
bd4jxucj7hqpvjv5646rxehevbia6gnym7y4kebj4cm3eugdwpma====
$ guix hash -S nar -f base32 -H sha256 -x ~/repo/public/linux
o3kzi5wtzct2roz4hprvmosv6te43kt5ha6vzefk2mmr5fybm2ua
$ python -m nar -f base32 -H sha256 ~/repo/public/linux
o3kzi5wtzct2roz4hprvmosv6te43kt5ha6vzefk2mmr5fybm2ua====
```

Related to T4538#93319

This also fixes complaints about short variable names.

```
$ guix hash -S nar -f base32 -H sha256 -x guix-modules
bd4jxucj7hqpvjv5646rxehevbia6gnym7y4kebj4cm3eugdwpma
$ python -m nar -f base32 -H sha256 guix-modules
it6djhqnacibff47lh43haq2bnu3w6pus72chbx4gjmzl2tppkda====
$ rm -rf guix-modules/.git  # because it's ignored by defaut by guix
$ python -m nar -f base32 -H sha256 guix-modules
bd4jxucj7hqpvjv5646rxehevbia6gnym7y4kebj4cm3eugdwpma====
```

Related to T4538#93319

Related to T4538#93319

This uses python-gitlab[1], and notably it uses the python-gitlab
CLI configuration scheme[2] instead of rolling our own.

[1] https://python-gitlab.readthedocs.io/
[2] https://python-gitlab.readthedocs.io/en/stable/cli-usage.html#configuration

Related to T4400

Related to T4400

used to initially import the infra

Currently only the loaders git really use it but they all need to mount the secret
volume (since it's using the same declaration). So it needs to be present in all
namespaces [1].

[1]
```
for TYPE in git bzr cvs maven pypi npm svn; do; kubectl apply -f loaders-metadata-fetcher.secret.yaml --namespace ns-loaders-$TYPE; done
secret/metadata-fetcher-credentials configured
secret/metadata-fetcher-credentials created
secret/metadata-fetcher-credentials created
secret/metadata-fetcher-credentials created
secret/metadata-fetcher-credentials created
secret/metadata-fetcher-credentials created
secret/metadata-fetcher-credentials created
```

Related to T4144

Related to T4144

This triggers a cascade of secrets to deploy to specific namespaces though.

Related to T4144

It was broken since a previous commit introduced the secrets for the loaders only.

Related to T4144

Related to T4144

This currently read the secrets and installs them properly in our config.yml the loader
uses to ingest origins.

It's currently convoluted but that's the simpler way for now. Short of changing the swh
tids and bits (loader, lister, ...) to actually allow using environment variables
instead of configuration here (sure but not right now).

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

Related to T4144

so they are actually written to disk