Security update for libzypp, zypper

The update fixes a security issue identified as LIBZYPP-LEGACY-CACHE-01 (bsc#1274625) that invalidates legacy unsigned repository cache states in libzypp. Previously, unsigned repositories explicitly accepted under legacy settings could remain unsigned until a signed version was retrieved, but now strict signature verification is enforced immediately after enabling repo_gpgcheck. The update also includes improvements such as preventing libgpgme from launching unnecessary gpg-agents, requiring both username and password for credentials, and enhancing solver problem rule logging. Zypper improvements include showing solver problem details by default in non-interactive mode and adding options to support Dockerfile builds.

The primary impact is improved security in repository metadata verification by enforcing strict signature checks, reducing the risk of accepting unsigned or potentially tampered repository data. This mitigates risks related to repository poisoning or supply chain attacks that could arise from unsigned repository metadata. Other fixes improve usability and reliability but do not directly affect security.

A security update is available and should be applied to libzypp and zypper to enforce strict repository signature verification and address the legacy cache invalidation issue. Users should update to the fixed versions as provided by the SUSE Product Security Team. No additional mitigations are required beyond applying this update.