* when the target servlet commit the response it is too late for the filter to be able to update the headers so doing it after the doFilter is a bad idea

- Fo roles, groups, process, users, case start and task data resources

covers [BPO-618](https://bonitasoft.atlassian.net/browse/BPO-618)

* feat(application API): Check image file size for image upload servlet

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

This PR changes permissions by reloading from the Engine the permissions each time we need to read them (still requires to add some cache Engine-side for performance)

Relates to [RUNTIME-175](https://bonitasoft.atlassian.net/browse/RUNTIME-175)
Relates to [RUNTIME-230](https://bonitasoft.atlassian.net/browse/RUNTIME-230)

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

* remove unused getConf method in SSO filters

* remove wrong and useless condition as it is already defined in
NoCaheFilter pattern in web.xml
* set the header after the chain.dofilter so that the firect filter in
the web.xml (NoCache filter) has priority

* fix(HTTP headers): enforce X-Content-Type and X-Frame headers

- set headers only once (use setHeader instead of addHeader)

Relates to [BPO-664](https://bonitasoft.atlassian.net/browse/BPO-664)

* the ApplicationAPI now returns a new parameter called `icon` that contains the url to the icon
* the icon is served by the servlet `../API/applicationIcon/<id>?t=<lastUpdateDate>`

example of application API response:
```
{
  updatedBy: "-1",
  displayName: "Admin app",
  lastUpdateDate: "1605275321167",
  description: "",
  themeId: "912",
  homePageId: "1001",
  creationDate: "1605275320903",
  version: "0.0.3",
  layoutId: "805",
  token: "admin",
  createdBy: "-1",
  profileId: "2",
  iconPath: "../API/applicationIcon/901?t=1605275321167"
  id: "901",
  state: "ACTIVATED",
  iconPath: ""
}
```

Relates to [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

so that `mvn clean test verify` does not have side effects
when run twice

Remove the last references to autologin, as it has already been removed functionaly

* Fix web.xml
* restore home page, download and image servlet
* restore URL rewrite filter
* Remove BonitaForm.html from portal look n feel

Few classes had to be moved from the forms module:
* ThemeExtractor
* URLUtils

so that web can pull Engine COMPILED with Java 11
even if for now, this repo still BUILDS with target Java 8

JDK 11 is used for compilation, except for GWT compilation, as it wouldn't work.
That's why we specify JDK8 path, just for GWT compilation.

* feat(application API): Add filter by userId

* remove groovy-all dependency
* only use groovy module
* other modules (json, nio..etc) are provided by the engine

== NOT RELATED ==
* Also, improve checkout by doing shallow clone

platform

- support empty config exclude pattern to override default
- remove X-XSS-Protection as IE is no longer supported
- separate X-Content-Type-Options and X-Frame-Options into different
servlet filter
- support exclusion pattern and configurable header values (in web.xml)

Relates to [BPO-664](https://bonitasoft.atlassian.net/browse/BPO-664)

Closes [RUNTIME-124](https://bonitasoft.atlassian.net/browse/RUNTIME-124)

* session invalidation was removed for SSO as keycloak already handle it
for OIDC and SAML and it was caussing issues to renew the session twice,
but it needs to remain for kerberos.

Covers [RUNTIME-67](https://bonitasoft.atlassian.net/browse/RUNTIME-67)

to be able to upgrade to Subscription more easily

Only the logics around the config file is removed.
The rest of the support of V6 form is still to be removed.
Related failing tests have been removed. This is dead code, so the risk is known and accepted.

Closes [RUNTIME-127](https://bonitasoft.atlassian.net/browse/RUNTIME-127)

- filter logoutservice call to perform OIDC logout in addition of bonita logout
- perform OIDC global logout with configured IdP URL
- only proceed to OIDC logout if there is a keycloak session. otherwise delegate to logoutservice
- only re create the HTTP session in case of a standard authentication
- support guest user behavior (add parameter to redirect to IdP login page when clicking on lign in in layout)

Covers [RUNTIME-68](https://bonitasoft.atlassian.net/browse/RUNTIME-68)

* feat(SSO): support authentication with OIDC

- add servlet filter and authentication manager
- support tenant configuration
- add compose file for manual tests
- add api to authentication filter
- exclude jackson to avoid conflict with the version provided by engine
- pass through keycloak OIDC filter even though there is a bonita
session or the URL is public if there is an OIDC account in the session
to avoid not detecting session change or invalid
- add specific authentication filter for the REST API in order to
benefit from the isAlready logged in rule that recreate the session if
the authentication manager lets you in

Covers [RUNTIME-57](https://bonitasoft.atlassian.net/browse/RUNTIME-57

)

Co-authored-by: hugues.bretin <hugues.bretin@bonitasoft.com>

- remove tests as this is unsupported code

* chore(branding): Add new information for full branding version name

* Add information in the release script

Co-authored-by: abirembaut <anthony.birembaut@bonitasoft.com>