Update slurm.spec and slurm.spec-legacy as well

Only trust MUNGE signed values, unless the RPC was signed by
SlurmUser or root.

CVE-2018-10995.

Already vetted by slurmctld/slurmd, no need to re-check here.

Do not defer until later, and do not potentially miss out on proper
validation of the user_name field which can lead to improper authentication
handling.

CVE-2018-10995.

If the auth value (from MUNGE) does not match the requested value,
ensure it is listed as a valid extended gid for that user instead.

Bug 5038.

Value of 2113 is where it fits in with 17.11, so pin it here.

Caused by pthread_cancel cleanup by commit e5f03971  in 17.11.6.

Bug 5181.

The race condition was created in a7c8964e in 17.11.6 when removing
the (unsafe) pthread_cancel code handling thread termination.

Bug 5164

Commits f18390e8 and eed76f85 modified the stepd so that if the
stepd encountered an unkillable step timeout that the stepd would just
exit the stepd. If the stepd is a batch step then it would reply back
to the controller with a non-zero exit code which will drain the node.
But if an srun allocation/step were to get into the unkillable step
code, the steps wouldn't let the waiting srun or controller know about
the step going away -- leaving a hanging srun and job.

This patch enables the stepd to notify the waiting sruns and the ctld of
the stepd being done and drains the node for srun'ed alloction and/or
steps.

Bug 5164

g_qos_count, g_qos_max_priority, must be call under qos write lock.

Bug 5159.

Display correct path.

Bug 5151

Gres logic was resulting in job submit failure for all jobs if no
GRES configured
bug 5191

Commits 4454316e and 76706b51 adjusted the updating of priority logic so
that when a non-authorized user modifies the priority it will only be
temporary -- in most cases the user will never see that change.

Bug 5151

Clarification of c2c06468.

Bug 5150

Locks are held already on entry to _fill_ctld_conf.

_fill_ctld_conf() will call in here with only the job read lock.
Calling get_next_job_id with test_only set to true is safe in
that scenario.