[Fix]: Upgrade across 3006.15 (0r 3007.7) generates spurious ppbt toolchain

[cjriches]

What does this PR do?

Move compileall to %posttrans to avoid accidental ppbt toolchain extract

The RPM specfile runs compileall in %post to byte-compile Python modules
under /opt/saltstack/salt/lib. This worked fine until commit 48c7d58
(Bump relenv version to 0.20.0).

In relenv >=0.20.0, the interpreter bootstrap actively imports ppbt and
extracts toolchains if available, rather than just checking if they're
already there. This should not have been a problem, as commit 4bd2832
(Remove ppbt after building the salt onedir) removed ppbt from the final
package so it never gets installed at runtime.

However, the subtleties of RPM scriptlet ordering cause issues on
upgrade. The %post scriptlet executes after the new version has been
installed, but before the stale files of the old version have been
removed. This means that ppbt is still present when the compileall runs,
so the bootstrap hooks extract the ppbt toolchain into
/root/.local/relenv.

This is usually harmless, but silently eats about 215 MiB of disk space,
which can be anywhere from mildly annoying to severely damaging
depending on how tight the root filesystem is.

Since both 48c7d58 and 4bd2832 went into 3006.15, any in-place
upgrade of salt that crosses this version will generate this spurious
toolchain.

Move the compileall into %posttrans, at which point we guarantee the old
package has been completely removed and we are only acting on the
correct python libraries.

Remove stale pycache on upgrade

When we regenerate the pycache on upgrade, stale files from removed
libraries may persist. Clear everything out first to avoid this.

For consistency, change the existing pycache clear-on-uninstall to use
the simpler -delete pattern instead of invoking xargs.

What issues does this PR fix or reference?

Fixes #68781

Merge requirements satisfied?

[NOTICE] Bug fixes or features added to Salt require tests.

• Docs
• Changelog - https://docs.saltproject.io/en/master/topics/development/changelog.html
• Tests written/updated

Commits signed with GPG?

No

[cjriches]

Ah, looks like the tests don't expect the posttrans. Will update.

(I see there are also some upgrade tests, but I reckon this is too weird and niche of an issue to be worth a specialised regression test?)

[welcome]

Congratulations on your first PR being merged! 🎉