v3.30.0

## Features

- ExpressVPN: OpenVPN additional ciphers (#1047)
- Storage:
  - add `"keep"` boolean field for servers to keep manually added servers
  - log time difference as a friendly duration
- Updater: configurable minimum ratio of servers found
  - `UPDATER_MIN_RATIO` environment variable
  - `-minratio` flag for CLI operation
- Docker: upgrade Alpine from 3.15 to 3.16 (#1005)
- Update servers data: Perfect privacy, Purevpn, Privatevpn, Private Internet Access, ProtonVPN, IPVanish, Surfshark
- Environment variables: clean values by removing surrounding spaces and suffix new line characters
- Wireguard: add debug logs for IPv6 detection which can be enabled with `LOG_LEVEL=debug`

## Fixes

- ExpressVPN: OpenVPN `fragment` option taken into account (#1047)
- Private internet access:
  - load custom certificate to communicate with their API
  - restrict custom port choice
- ProtonVPN:
  - set free field for free servers, fixing `FREE_ONLY` behavior
  - remove duplicate entry IPs
  - restrict custom port choice
- Wireguard: continue on ipv6 route add permission denial
- VPN: do not close wait error channel on consumer side
- Port forwarding: set file owned by the uid and gid set by `PUID` and `PGID`
- Private Internet Access: remove duplicate log of port forwarding data expiration
- Pprof settings: override method used correctly in global settings
- Updater: Fix CLI operation not setting DNS server
- IPVanish: remove duplicate server entries
- Custom: validate custom OpenVPN file at settings validation

## Documentation

- Bug issue template: fix render of logs to be `plain text` instead of `log`
- ProtonVPN: document in code to remove `SERVER_NAMES`
- Update maintenance.md document

## Maintenance

### Easy to add VPN providers

- `internal/provider/example` new package
- Readme: simplify heading description
- `internal/updater`: check each server has minimal information
- `internal/storage`: modify JSON tests to not need all providers listed
- `internal/provider/common` new package: shared interfaces and errors for all providers
- `internal/provider`: new `Providers` contains a map from provider string name to provider interface
- Use the same provider object for both updating servers and to setup the VPN
- Initialize all providers at start in the `Providers` map
- `internal/provider/*`:
  - incorporate updating `FetchServers` method in `Provider` interface
  - Rename each provider updater subpackage name to `updater`
  - add `Name()` method per provider
  - rename all provider structs to `Provider`
  - rename all test functions to `Test_Provider_GetConnection`
- `internal/updater`: Updater `update` method takes in a slice of provider strings
- `internal/storage`: common sorting for all servers
- `internal/provider/surshark/servers/locationdata.go` merging both `internal/models/location.go` and `internal/constants/surfshark.go`
- `internal/models`: provider to servers map in `allServers`:
  - Custom JSON marshaling methods for `AllServers`
  - Simplify formatting CLI
  - Simplify updater code
  - Simplify filter choices for config validation
  - Simplify all servers deep copying
  - Simplify provider constructor switch
  - Simplify storage merging
  - Simplify storage reading and extraction
- `internal/storage/servers.json`: change provider names to match string constants in code
  - From `pia` to `private internet access`, and reset version to `1`
  - From `perfectprivacy` to `perfect privacy`, and reset version to `1`
  - From `vpnunlimited` to `vpn unlimited`, and reset version to `1`
- `internal/cli`: refactor `FormatServers` to use provider strings
- `internal/provider/utils`: unexport no longer externally needed functions
- `internal/provider`: add `GetConnection` test

### Continuous integration

- Fix trigger for Docker image publish job
- Merge jobs and workflows into the `verify` job of the CI workflow:
  - CodeQL job
  - Dependabot workflow
  - Fork workflow
- Fix behavior on pull requests from forked repositories
  - Run Docker Hub description job only on base repository
  - Run Docker image publish job only on base repository
- Build base repository pull request Docker images with tag `:pr-N` (#1026)
- Add skip workflow for required verify job
- Restrict permissions to read actions+contents for all jobs
- Remove go.mod tidy check job
  - Not really needed with newer `go install`
  - Conflicts with Go 1.17 go.mod format
  - Conflicts with manual indirect dependency upgrade
- Bump docker/setup-buildx-action from 1 to 2 (#977)
- Bump docker/setup-qemu-action from 1 to 2 (#978)
- Bump docker/build-push-action from 2.10.0 to 3.0.0 (#979)
- Bump docker/metadata-action from 3 to 4 (#980)
- Bump docker/login-action from 1 to 2 (#981)
- Bump crazy-max/ghaction-github-labeler from 3 to 4 (#1007)

### Other

Storage: memory and thread safe servers data storage
  - only pass hardcoded versions to read file and discard outdated servers
  - unexport `SyncServers` method
  - minimal deep copying and data duplication
  - add merged servers mutex for thread safety
  - settings: get filter choices from storage for settings validation
  - updater:
    - update servers to the storage
    - get servers count from storage directly
    - equality check done by the storage
  - connection: filter servers in storage
  - formatter: format servers to Markdown in storage
  - PIA: get server by name from storage directly
- `internal/openvpn/extract`: `extract.PEM` replaces all PEM parse functions
- `internal/constants/openvpn` new package for OpenVPN related constants.
- `internal/wireguard`: add check for empty public key for Wireguard
- `internal/publicip`:
  - Exported `Fetcher` interface
  - Inject `Fetcher` to publicip loop and updaters
  - Get public IP and information at the same time
  - Only query ipinfo.io
  - Make `MultiInfo` part of the `Fetch` object
  - `internal/publicip/ipinfo` package
- Updater:
  - DNS address as `host:port` string in settings structure
  - Remove unneeded ctx error check in cyberghost updating code
  - `UpdateServers` returns an error if it fails updating a single provider
  - Inject a common resolver to each provider instead of creating a unique one per provider, and use resolver settings on every call to its `.Resolve` method
  - Move out minServers check from resolver
  - `internal/updater/loop` subpackage
  - `internal/server`: more restrictive updater loop interface
- Renamings:
  - updater: rename all `presolver` to `parallelResolver`
  - storage: rename `InfoErrorer` to `Infoer`
  - provider: rename all `BuildConf` methods to `OpenVPNConfig`
  - updater: rename all `GetServers` methods to `FetchServers`
- Entire codebase changes:
  - remove unexported Go interfaces
  - remove package comments
  - return concrete types, accept interfaces
- Upgrade `gopkg.in/yaml.v3` to v3.0.1 to fix (dull) vulnerability alert on Github

### Development

- See [Easy to add VPN providers](#Easy-to-add-VPN-providers) related work
- `.vscode/launch.json` to update servers - Credits to @Rohaq
- `go4.org/unsafe/assume-no-moving-gc` upgraded to allow development using Go 1.18 without `ASSUME_NO_MOVING_GC_UNSAFE_RISK_IT_WITH=go1.18`
- Linting:
  - upgrade golangci-lint from v1.44.2 to v1.46.2
  - review exclude rules
  - `ireturn`, `execinquery` and `nosprintfhostport` linters added
- Use casers instead of `strings.Title` to remove Go 1.18 linting warnings
  - Add `golang.org/x/text` dependency
  - Update code to use `cases.Title(language.English)`
- Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 (#1016)