CI: Add centos stream 10 build

.cirrus.yml

@@ -254,13 +254,22 @@ fedora41_task:
 
 centosstream9_task:
   container:
-    # Stream 9 EOL: Around Dec 2027
+    # Stream 9 EOL: 31 May 2027
     dockerfile: ci/centos-stream-9/Dockerfile
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
   << : *ONLY_IF_PR_MASTER_RELEASE
   << : *SKIP_IF_PR_NOT_FULL_CI
 
+centosstream10_task:
+  container:
+    # Stream 10 EOL: 01 January 2030
+    dockerfile: ci/centos-stream-10/Dockerfile
+    << : *RESOURCES_TEMPLATE
+  << : *CI_TEMPLATE
+  << : *ONLY_IF_PR_MASTER_RELEASE
+  << : *SKIP_IF_PR_NOT_FULL_CI
+
 debian13_task:
   container:
     # Debian 13 (trixie) EOL: TBD

ci/centos-stream-10/Dockerfile

@@ -0,0 +1,49 @@
+FROM quay.io/centos/centos:stream10
+
+# A version field to invalidate Cirrus's build cache when needed, as suggested in
+# https://github.com/cirruslabs/cirrus-ci-docs/issues/544#issuecomment-566066822
+ENV DOCKERFILE_VERSION 20250905
+
+# dnf config-manager isn't available at first, and
+# we need it to install the CRB repo below.
+RUN dnf -y install 'dnf-command(config-manager)'
+
+# What used to be powertools is now called "CRB".
+# We need it for some of the packages installed below.
+# https://docs.fedoraproject.org/en-US/epel/
+RUN dnf config-manager --set-enabled crb
+RUN dnf -y install \
+    https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
+
+# The --nobest flag is hopefully temporary. Without it we currently hit
+# package versioning conflicts around OpenSSL.
+RUN dnf -y --nobest install \
+    bison \
+    ccache \
+    cmake \
+    cppzmq-devel \
+    diffutils \
+    flex \
+    gcc \
+    gcc-c++ \
+    git \
+    jq \
+    libpcap-devel \
+    make \
+    openssl \
+    openssl-devel \
+    procps-ng \
+    python3 \
+    python3-devel \
+    python3-pip\
+    sqlite \
+    swig \
+    tar \
+    which \
+    zlib-devel \
+  && dnf clean all && rm -rf /var/cache/dnf
+
+# Set the crypto policy to allow SHA-1 certificates - which we have in our tests
+RUN dnf -y --nobest install crypto-policies-scripts && update-crypto-policies --set LEGACY
+
+RUN pip3 install websockets junit2html