Implement CVS fetcher (#23212)

Spack packages can now fetch versions from CVS repositories. Note
this fetch mechanism is unsafe unless using :extssh:. Most public
CVS repositories use an insecure protocol implemented as part of CVS.

var/spack/repos/builtin.mock/packages/cvs-test/package.py

@@ -0,0 +1,13 @@
+# Copyright 2013-2021 Lawrence Livermore National Security, LLC and other
+# Spack Project Developers. See the top-level COPYRIGHT file for details.
+#
+# SPDX-License-Identifier: (Apache-2.0 OR MIT)
+
+from spack import *
+
+
+class CvsTest(Package):
+    """Mock package that uses cvs for fetching."""
+    homepage = "http://www.cvs-fetch-example.com"
+
+    version('cvs', cvs='to-be-filled-in-by-test')