Add new fields on the application:
* editable field
* visibility field

covers [RUNTIME-286](https://bonitasoft.atlassian.net/browse/RUNTIME-286)

So that there is no need to redefine the version when declaring the dependency.

Relates to [RUNTIME-296](https://bonitasoft.atlassian.net/browse/RUNTIME-296)

so that there is not private BOM (that would be harder to pull in Maven)

Relates to [RUNTIME-296](https://bonitasoft.atlassian.net/browse/RUNTIME-296)

with weird / unused artifacts

BOM = Bill of Materials

* org.bonitasoft.console:bonita-web-bom
* org.bonitasoft.console:bonita-web-sp-bom

these boms contains all runtime dependencies used by the web modules

Closes [RUNTIME-296](https://bonitasoft.atlassian.net/browse/RUNTIME-296)

Relates to [RUNTIME-296](https://bonitasoft.atlassian.net/browse/RUNTIME-296)

* avoid creating the HTTP session in case of a SAML authentication as informations stored in it by keycloak are lost
This is not a big issue for most use cases as, once you get a bonita session, we don't go through keycloak filter code. However for some features like global logout, this may be an issue if you use POST response binding.
Also, it appears that Keycloak already provide a mechanism to recreate the session when logging in with the option turnOffChangeSessionIdOnLogin="false"
* update keycloak conf example

Cover [RUNTIME-293](https://bonitasoft.atlassian.net/browse/RUNTIME-293)

* Return the bdm information instead of the filePath when uploading a new bdm

covers [RUNTIME-70](https://bonitasoft.atlassian.net/browse/RUNTIME-70

)

Co-authored-by: Emmanuel Duchastenier <emmanuel.duchastenier@bonitasoft.com>

* remove the token placeholders to disable some parts of the web.xml
This is no longer needed as part of the GWT removal
* remote portal is not allowed anymore so put bonita-engine(-sp) directly in bonita.war(-sp)
* fix transitive deps issue

* when the target servlet commit the response it is too late for the filter to be able to update the headers so doing it after the doFilter is a bad idea

- Fo roles, groups, process, users, case start and task data resources

covers [BPO-618](https://bonitasoft.atlassian.net/browse/BPO-618)

* feat(application API): Check image file size for image upload servlet

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

This PR changes permissions by reloading from the Engine the permissions each time we need to read them (still requires to add some cache Engine-side for performance)

Relates to [RUNTIME-175](https://bonitasoft.atlassian.net/browse/RUNTIME-175)
Relates to [RUNTIME-230](https://bonitasoft.atlassian.net/browse/RUNTIME-230)

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

covers [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

* remove unused getConf method in SSO filters

* remove wrong and useless condition as it is already defined in
NoCaheFilter pattern in web.xml
* set the header after the chain.dofilter so that the firect filter in
the web.xml (NoCache filter) has priority

* fix(HTTP headers): enforce X-Content-Type and X-Frame headers

- set headers only once (use setHeader instead of addHeader)

Relates to [BPO-664](https://bonitasoft.atlassian.net/browse/BPO-664)

* the ApplicationAPI now returns a new parameter called `icon` that contains the url to the icon
* the icon is served by the servlet `../API/applicationIcon/<id>?t=<lastUpdateDate>`

example of application API response:
```
{
  updatedBy: "-1",
  displayName: "Admin app",
  lastUpdateDate: "1605275321167",
  description: "",
  themeId: "912",
  homePageId: "1001",
  creationDate: "1605275320903",
  version: "0.0.3",
  layoutId: "805",
  token: "admin",
  createdBy: "-1",
  profileId: "2",
  iconPath: "../API/applicationIcon/901?t=1605275321167"
  id: "901",
  state: "ACTIVATED",
  iconPath: ""
}
```

Relates to [RUNTIME-114](https://bonitasoft.atlassian.net/browse/RUNTIME-114)

so that `mvn clean test verify` does not have side effects
when run twice

Remove the last references to autologin, as it has already been removed functionaly

* Fix web.xml
* restore home page, download and image servlet
* restore URL rewrite filter
* Remove BonitaForm.html from portal look n feel

Few classes had to be moved from the forms module:
* ThemeExtractor
* URLUtils

so that web can pull Engine COMPILED with Java 11
even if for now, this repo still BUILDS with target Java 8

JDK 11 is used for compilation, except for GWT compilation, as it wouldn't work.
That's why we specify JDK8 path, just for GWT compilation.

* feat(application API): Add filter by userId

* remove groovy-all dependency
* only use groovy module
* other modules (json, nio..etc) are provided by the engine

== NOT RELATED ==
* Also, improve checkout by doing shallow clone

platform

- support empty config exclude pattern to override default
- remove X-XSS-Protection as IE is no longer supported
- separate X-Content-Type-Options and X-Frame-Options into different
servlet filter
- support exclusion pattern and configurable header values (in web.xml)

Relates to [BPO-664](https://bonitasoft.atlassian.net/browse/BPO-664)

Closes [RUNTIME-124](https://bonitasoft.atlassian.net/browse/RUNTIME-124)