server side resource consumption attack.
- bcrypt heavy computation can lead to DOS using a very long password .eg 10**8 lenght.
- we allowed this on registration or on password update
- added mandatory reviewers JS logic Fixes: #4219
- added option to forbid author to be a reviewer via JS/Frontend checks. Fixes#5190
- added option to forbid adding new reviewers except those defined. Fixes#5208
- fixes#4003
- adds new settings to automatically create personal repo groups for users on API cal, add user form, registration
- it's possible to create a pattern based repo group for example /u/{username}
- removed old two column selector in replacement of autocomplete list
- scales much better for alrge number of users
- still allows to select single users and user groups
- fixes#4291 (user group shows only username in members)
- vcs middleware now returns dummyHandler if not configured
- propagate the per-repo vcs related configs into VCSMiddleware
- moved the forms arround and group things into more logical blocks
This fixes#3374. There's no good benefit of having possibility to prevent
setting disabled user from beeing an owner.
It can happen that we start preperating a system and use disabled accounts.
Also users shouldn't be forbidden to edit settings on an disabled owner.
