Update to 4.0.22 - #44

Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.57 to 3.1.58.
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.57...3.1.58)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-version: 3.1.58
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

NIST's Vulnerability API renamed this query parameter (cveId is
deprecated, cveIds is current). This one-line fix was generated and
verified by SelfHeal: applied to an isolated, network-disabled copy of
this exact commit, compiled, and run against this repo's own test suite
before and after (540 passed, 0 failed, both times, non-flaky across
repeated runs). Full evidence -- byte hashes, test logs, the isolation
config -- is on file at:
https://github.com/KarloffsGhost/Selfheal/tree/main/validation/corpus/results/nvd_patchman_full_application_20260729T0330Z

This commit is on a personal fork as a real, reproducible demonstration
of that verified fix -- not a submission to the upstream project.

find_deb_kernel_updates() already skips meta-packages such as
linux-image-generic when looking for kernel updates, but the reboot
check at the end of the function still compares them against the
running kernel. The meta-package version (e.g. 5.15.0.198.171) always
sorts above the kernel package it depends on (5.15.0-198.208), so every
Ubuntu host with linux-image-generic installed is marked as requiring a
reboot, even when it runs the newest installed kernel.

Skip linux-image-* packages without a kernel series, the same test the
update loop uses.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

See furlongm#690 (comment):
if you upgrade a Patchman 3 setup to Patchman 4, the migrations don't
correctly alter the hosts_host table and leave the tags column as NOT
NULL, which then causes issues processing reports for previously unseen
hosts.  Host.objects.get_or_create() raises, the exception is caught
and logged, and then subsequent `if host:` check fails with an

  UnboundLocalError: cannot access local variable 'host' where it is not associated with a value

skip-checks: true

skip-checks: true