fix(build): make the Linux packages usable on Ubuntu 22.04

[manusa]

Prepares the AppImage for submission to the AppImage catalog
(#721) and fixes what checking it against their checklist turned up.

The spell checker doesn't load on Ubuntu 22.04

nodehun is compiled on the machine that builds the packages, so it links against its
glibc and libstdc++. The Linux release builds on ubuntu-latest, now 24.04, so the
0.0.123 AppImage and tar.gz need GLIBC_2.38 and GLIBCXX_3.4.32, which Ubuntu 22.04
(glibc 2.35, GLIBCXX_3.4.30) does not have. The application still starts, and only
spell checking is gone, because the failure is handled.

• Both the release job and the Linux Build job now run in a container: ubuntu:22.04.
• The snap moved to its own job, as snapcraft does not run in docker. publish-snap.yml
  already built it separately.
• utils/check-glibc.sh fails the build when a native binary in the AppImage needs more
  than Ubuntu 22.04 provides, so this cannot regress unnoticed.

AppStream metainfo

build-config/com.marcnuri.electronim.appdata.xml is installed in usr/share/metainfo,
and build-config/electronim.package.desktop in usr/share/applications alongside it,
because appstreamcli validate-tree (which the catalog's appdir-lint.sh runs) looks
for the launchable there while electron-builder only writes its desktop file to the root
of the AppImage. That entry is a new one with a relative Exec=electronim %U and
Icon=electronim, not the RPM's /opt/electronim one, because the tar.gz ships a
usr/share tree a user can install. Tests keep it in sync with build.linux. The
metainfo keeps the legacy *.appdata.xml name because the catalog only reads listing
data from files named that way. Its description says that ElectronIM is free/libre
software: software centers show the licence name, but nothing else tells users that.

It ships without <screenshots> for now, and that is why this PR does not unblock
the catalog submission on its own: in the catalog's worker.sh the appdata branch wins
over the auto-screenshot branch, so a metainfo file without screenshots means the listing
shows no image at all. #721 tracks adding one, pinned to a commit, before the catalog PR.

Smaller things found while reviewing the above

• utils/version-from-tag.js stamps the AppStream <releases> at tag time, so software
  centers show a version and a date. The version is only known then.
• The RPM installs the metainfo in %{_metainfodir}, where Fedora's software center
  scans for it, and no longer carries the stray copies under /opt/electronim/usr. It
  still builds older tags, which Copr builds with the spec on main and which have no
  metainfo: %files takes it from a list %install only writes when the file exists.
• The release workflow declares permissions: contents: write, which is all the uploads
  need, hands GITHUB_TOKEN to the upload steps only rather than to npm install and the
  install scripts it runs, and checks out without persisting git credentials. Nothing in
  those jobs pushes.
• One sentence now describes the application in the metainfo, package.json, the snap
  summary, the linux synopsis, the RPM Summary: and the Comment of both desktop
  entries, instead of four different ones.
• squashfs-root is ignored by git and excluded from build.files, so extracting an
  AppImage in the working tree can't end up inside the next app.asar.
• docs/Setup.md ran tar xz without -f.

Verification

Built in an ubuntu:22.04 container, the same way the new jobs do, and checked the
resulting AppImage on Ubuntu 22.04:

• utils/check-glibc.sh: every native binary loads with the versions Ubuntu 22.04
  provides. The same check on the released 0.0.123 AppImage fails and names
  Nodehun.node. It reads only the version needs section, so bundling a library that
  defines newer versions is not mistaken for needing them; it also rejects the
  GLIBC_ABI_DT_RELR requirement that Ubuntu 24.04's default link flags add, and fails
  when a path cannot be listed rather than reporting an empty scan as success.
• The catalog's appdir-lint.sh: Lint found no fatal issues, and
  desktop-file-validate passes.
• appstreamcli validate: clean on AppStream 0.15.2 (22.04) and 1.0.2 (24.04).
• Started offline (--network=none) under Xvfb on 22.04: the settings dialog opens on
  first launch and nothing logs a GLIBC error, where the released AppImage logs
  version `GLIBC_2.38' not found.
• npm run pretest and npm test (62 suites, 1199 tests) pass.

The snap has the same problem and is worse, since core20 provides only GLIBCXX_3.4.28.
That is tracked separately in #724, to be done on a Linux machine.

Refs #721

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud