There was common situations where two provider instances where running
in parallel. And was creating weird errors (like getting wrong api_uri)
because the bootstrap deferreds were global but the Provider objects
not.

I don't like much singletons, but I think now is simpler than before.

- Resolves: #9073

we make a distinction between the system-wide bitmask-root, which should
be placed there by the maintainers of whatever packages your
distribution uses, and the bitmask-root that is placed by the bundles
(using polkit).

since the bundles copying over the helper from user-writeable folders
is a potential attack vector, we prefer to use the package's version if
present.

also, if we cannot find either, we abort the launching of the VPN. we've
discussed that this might move to the service initialization instead,
but I think the cases in which this is needed should be rare.

I fix also a corner-case in which we were using getcwd() at import time.
if you execute code and then remove the installation path, this will
raise a traceback in bitmaskctl. I think it's nicer to catch the error
properly when starting.

the released soledad packages didn't list soledad-common as a dependency
for client.

this change can be reverted after releasing soledad 0.10.4

-Resolves: #9065

the package from docker was being copied with the `dist` name.