ci/ipsec: Fix downgrade version for release preparation commits

[qmonnet]

For the IPsec upgrade/downgrade CI test, for the jobs where we upgrade/downgrade to the closest patch release, the script print-downgrade-version.sh determines the patch release by picking up the value in file VERSION. This works most of the time.

For release preparation commits, however, this approach fails because the reference in VERSION points to a release that has not been tagged or published yet. We need to pick the previous patch release in that case.

However, it's non-trivial to figure out whether we're on a release preparation commit, in particular because the CI workflow does a shallow Git clone and we don't have access to the Git history. I couldn't find an ideal solution, so this commit changes the shallow-clone into a clone with 2 commits (one for the last commit, which is the one we're interested in, and another one squashing all the rest of the history). And we add a hack in the script to account for this last commit and check whether it modifies the VERSION file. If it does, we decrement the version found in VERSION before computing the patch release to downgrade to.

Fixes: 5581963 ("ci/ipsec: Fix version retrieval for downgrades to closest patch release")

[qmonnet]

/test

[qmonnet]

/test

[julianwiedmann]

Just to brain-storm on less-hacky alternatives a bit more. Would a checkout with fetch-tags: true help us? And instead of comparing VERSION, testing whether the expected tag exists?

[qmonnet]

Ha! So as it turns out, fetch-tags: true doesn't work with fetch-depth: 0, we don't retrieve any tags (presumably because we don't have the commits to associate them with). I'll send a fix to the fix to the fix 🙃, switch back to the VERSION-update based check.

[EDIT: And this will be in #30742.]