Revert setcap, update rust and crates

[BlackDex]

• Revert Allow listening on privileged ports (below 1024) as non-root #3170 as discussed in v1.28.0 requires the NET_BIND_SERVICE capability #3387
  This appears to be a breaking change on some platforms.
  And in hindsight it's better to not have this feature as there might be (hypothetical) security issues with this.
• Update Dockerfile.j2 for easy version changes.
  Just change it in one place instead of multiple
• Updated to Rust to latest patched version
• Updated crates to latest available
• Pinned mimalloc to an older version, as it breaks on musl builds

Resolves #3387

[jjlin]

For the record, I disagree with the characterization that it's "better" not to have #3170 just because a handful of users who are fixated with dropping all possible capabilities (even though they haven't presented any practical downside to keeping NET_BIND_SERVICE) feels strongly about it. Having stronger feelings and being more vocal doesn't make them more right.

[BlackDex]

I'm not saying that it makes something more right or wrong when people are complaining about something strongly or not strongly or whatever.

But, in hindsight I do agree that we should not lower the security of the container just because we should have set ROCKET_PORT to 8000 or something from the beginning.

The issue I have with this being there, is that it might be an entry point for someone to add a custom binary, or maybe even abuse a binary already in the image to start that on a lower port.

I think we need to prevent stuff like that. And new users can be educated on how to start a Vaultwarden container.

[jjlin]

IMO, that argument is even more hypothetical than the "hypothetical" users that #3170 is supposed to benefit, but if that's your opinion, that's fine.

[BlackDex]

IMO, that argument is even more hypothetical than the "hypothetical" users that #3170 is supposed to benefit, but if that's your opinion, that's fine.

Well besides that, i also think we should not make breaking changes like this.And apparently this was a breaking change for people running k8s or a bit more secure environments. And I would prefer a secure environment above a less secure environment.

Please don't feel personally attacked by this, because that isn't the case.

[jjlin]

If the real reasoning is to minimize breaking changes, then just say that. The rest is security theater. Modern versions of Docker already allow any process to bind to low ports regardless of NET_BIND_SERVICE, but I don't see these guys passing --sysctl net.ipv4.ip_unprivileged_port_start=1024...

[BlackDex]

Both arguments apply. Not just one or the other.
I don't think it's security theater.
Also arguing that Docker already has this feature built in is a bad argument, since docker isn't the only container platform.

Anyways, main reasons are breaking change and security.