* avoid creating the HTTP session in case of a SAML authentication as informations stored in it by keycloak are lost
This is not a big issue for most use cases as, once you get a bonita session, we don't go through keycloak filter code. However for some features like global logout, this may be an issue if you use POST response binding.
Also, it appears that Keycloak already provide a mechanism to recreate the session when logging in with the option turnOffChangeSessionIdOnLogin="false"
* update keycloak conf example

Cover [RUNTIME-293](https://bonitasoft.atlassian.net/browse/RUNTIME-293)

* Return the bdm information instead of the filePath when uploading a new bdm

covers [RUNTIME-70](https://bonitasoft.atlassian.net/browse/RUNTIME-70

)

Co-authored-by: Emmanuel Duchastenier <emmanuel.duchastenier@bonitasoft.com>

* remove the token placeholders to disable some parts of the web.xml
This is no longer needed as part of the GWT removal
* remote portal is not allowed anymore so put bonita-engine(-sp) directly in bonita.war(-sp)
* fix transitive deps issue

* when the target servlet commit the response it is too late for the filter to be able to update the headers so doing it after the doFilter is a bad idea

- Fo roles, groups, process, users, case start and task data resources

covers [BPO-618](https://bonitasoft.atlassian.net/browse/BPO-618)

* feat(application API): Check image file size for image upload servlet

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

This PR changes permissions by reloading from the Engine the permissions each time we need to read them (still requires to add some cache Engine-side for performance)

Relates to [RUNTIME-175](https://bonitasoft.atlassian.net/browse/RUNTIME-175)
Relates to [RUNTIME-230](https://bonitasoft.atlassian.net/browse/RUNTIME-230)

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

* remove unused getConf method in SSO filters

* remove wrong and useless condition as it is already defined in
NoCaheFilter pattern in web.xml
* set the header after the chain.dofilter so that the firect filter in
the web.xml (NoCache filter) has priority

* fix(HTTP headers): enforce X-Content-Type and X-Frame headers

- set headers only once (use setHeader instead of addHeader)

Relates to [BPO-664](https://bonitasoft.atlassian.net/browse/BPO-664)

* the ApplicationAPI now returns a new parameter called `icon` that contains the url to the icon
* the icon is served by the servlet `../API/applicationIcon/<id>?t=<lastUpdateDate>`

example of application API response:
```
{
  updatedBy: "-1",
  displayName: "Admin app",
  lastUpdateDate: "1605275321167",
  description: "",
  themeId: "912",
  homePageId: "1001",
  creationDate: "1605275320903",
  version: "0.0.3",
  layoutId: "805",
  token: "admin",
  createdBy: "-1",
  profileId: "2",
  iconPath: "../API/applicationIcon/901?t=1605275321167"
  id: "901",
  state: "ACTIVATED",
  iconPath: ""
}
```

Relates to [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

so that `mvn clean test verify` does not have side effects
when run twice

Remove the last references to autologin, as it has already been removed functionaly

* Fix web.xml
* restore home page, download and image servlet
* restore URL rewrite filter
* Remove BonitaForm.html from portal look n feel

Few classes had to be moved from the forms module:
* ThemeExtractor
* URLUtils

so that web can pull Engine COMPILED with Java 11
even if for now, this repo still BUILDS with target Java 8

JDK 11 is used for compilation, except for GWT compilation, as it wouldn't work.
That's why we specify JDK8 path, just for GWT compilation.

* feat(application API): Add filter by userId

* remove groovy-all dependency
* only use groovy module
* other modules (json, nio..etc) are provided by the engine

== NOT RELATED ==
* Also, improve checkout by doing shallow clone

platform

- support empty config exclude pattern to override default
- remove X-XSS-Protection as IE is no longer supported
- separate X-Content-Type-Options and X-Frame-Options into different
servlet filter
- support exclusion pattern and configurable header values (in web.xml)

Relates to [BPO-664](https://bonitasoft.atlassian.net/browse/BPO-664)

Closes [RUNTIME-124](https://bonitasoft.atlassian.net/browse/RUNTIME-124)

* session invalidation was removed for SSO as keycloak already handle it
for OIDC and SAML and it was caussing issues to renew the session twice,
but it needs to remain for kerberos.

Covers [RUNTIME-67](https://bonitasoft.atlassian.net/browse/RUNTIME-67)

to be able to upgrade to Subscription more easily

Only the logics around the config file is removed.
The rest of the support of V6 form is still to be removed.
Related failing tests have been removed. This is dead code, so the risk is known and accepted.

Closes [RUNTIME-127](https://bonitasoft.atlassian.net/browse/RUNTIME-127)

- filter logoutservice call to perform OIDC logout in addition of bonita logout
- perform OIDC global logout with configured IdP URL
- only proceed to OIDC logout if there is a keycloak session. otherwise delegate to logoutservice
- only re create the HTTP session in case of a standard authentication
- support guest user behavior (add parameter to redirect to IdP login page when clicking on lign in in layout)

Covers [RUNTIME-68](https://bonitasoft.atlassian.net/browse/RUNTIME-68)