Merge upstream main into v6 upgrade branch

Keep the runtime jwt-keys sidecar (cc-ci cannot pre-insert PEM secrets) and
the Rust docspec image on top of upstream v6.0.4.

release/1.0.0+v6.0.3

@@ -0,0 +1,22 @@
+⚠️ Major upgrade to Docs v6: the collaboration server is replaced by the new `yhub`
+service, and existing documents have to be migrated to it, or they open EMPTY.
+
+Before deploying, generate and insert two RSA keys:
+
+  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out jwt.pem
+  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out yhub-jwt.pem
+  abra app secret insert <app-name> jwt_pk v1 jwt.pem -f
+  abra app secret insert <app-name> yhub_jwt_pk v1 yhub-jwt.pem -f
+
+and add to your app config:
+
+  SECRET_JWT_PK_VERSION=v1 # generate=false
+  SECRET_YHUB_JWT_PK_VERSION=v1 # generate=false
+
+`SECRET_COLLAB_SS_VERSION` and the `collab_ss` secret are no longer used.
+
+After deploying (SOFT_MIGRATION is on by default), migrate all documents:
+
+  abra app cmd <app-name> backend migrate_documents
+
+Only then may you set SOFT_MIGRATION=false. See the README for details.