feat: the configuration that says which services run together (4.17.0)

ServiceClustersMixin.get_service_clusters() -> ServiceClustersDict
{patroni, adguardhome_sync, bunkerweb}: per mechanism the clusters the
host's configuration says it belongs to, each with its members (address,
port, name, role as the mechanism words it, this_host, config_from) and the
unit or container it was read from (source).

- Patroni: scope, name and restapi.connect_address from its YAML, then the
  members and roles /cluster lists from the DCS.
- adguardhome-sync: ORIGIN_URL and REPLICA*_URL; the origin pushes to each
  replica.
- BunkerWeb: a worker's API_WHITELIST_IP names the manager it admits, a
  manager's BUNKERWEB_INSTANCES its workers.

Two hosts answering at one virtual IP prove nothing; this is the evidence
that they run one service (NetOrk/netork#1125). One generic command for
every Linux host, filtered on the host like the virtual IPs' one:
allowlisted fields only, URLs without user:password@, DCS endpoints stay
there. Root first, then without it; None per mechanism is "did not look".

README.md

@@ -154,6 +154,22 @@ A mechanism it could not read completely is `None` ("did not look"), a host with
 `[]`. The command is about 4 kB, so a driver sends it on an exec channel
 (`_run_virtual_ips_command(command, privileged=)`), not typed into a shell.
 
+`ServiceClustersMixin` (`get_service_clusters`) reads the configuration that proves two
+hosts run one service together -- not merely that they answer at one address: Patroni
+(`scope`, `name` and `restapi.connect_address` from its YAML, then the members and roles
+its REST API's `/cluster` lists from the DCS), adguardhome-sync (`ORIGIN_URL` and
+`REPLICA*_URL` of its container: the origin pushes to each replica) and BunkerWeb (a
+worker's `API_WHITELIST_IP` names the manager it takes its configuration from, a manager's
+`BUNKERWEB_INSTANCES` its workers). Each member carries its role as the mechanism words it
+and the index of the member it takes its configuration from (`config_from`). The same
+configuration holds the superuser password, the sync's logins and BunkerWeb's database URI,
+so awk programs filter **on the host**: allowlisted fields only, a URL without its
+`user:password@`, and the DCS endpoints stay on the host. Root first (Patroni's YAML is the
+postgres user's), then without it. `None` per mechanism is "did not look", `[]` "has none".
+The container engine is asked through `_container_engine_binary` where the driver has one.
+A driver sends the command on an exec channel (`_run_service_clusters_command(command,
+privileged=)`).
+
 `get_dhcp_ha` (declared on `DhcpServerMixin`, optional) is what a DHCP server's own HA
 configuration says: whether HA is on, which peer this server is, each peer's name, role --
 as the server words it, not a shared vocabulary -- and, where the server has one, the URL