CFID-402: /Groups/{group}/Users endpoint

A special purpose endpoint for use as a user id/name
translation api.  It will be used by vmc so it has
to be quite restricted in function (i.e. it's not
a general purpose groups or users endpoint).  You
can only query it, as a user, for usernames and user
ids in the same group as you.  Otherwise the API
is the same as /Users.

[Fixes #35352703]

Change-Id: Ia592eb3bcf77b8afaef7e7b1f6bf9a3bc548ce62
Merge "CFID-402: /Groups/{group}/Users endpoint" into develop
start support for groups and general queries in uaa gem

Change-Id: Ica2371209d529db132c34d7a00030f6a3f48fd37
Added support for a distinct token target

Refactored to remove target from the http module

This enables the gem to support multiple targets, one for the authorize
and the other for the token endpoint

uaac target now supports a token target in addition to an authorize
target

Change-Id: I6c1d191e7073d8f2b33a2b689e57fb3da7b2230b
CFID-402: add docs for /Groups/{group}/Users

[Fixes #35352703] user id/name translation api

Change-Id: I583cee73bc13122177ac8e61f636a2f9738ed2fa
[#35598249] Conflicts uncommitted in gem (635ac69f)

Change-Id: Ia50239f5510abe57a5b6550e333bf4c044b31152
Fixed breaking tests

Change-Id: I8393f1e998f3c8018a9b03a2f87cc588dcee85e1
[Fixes #35655999] Gem does not strip "/" from target url

Change-Id: I73c62f5b0f35ad577f47269820416543027d1b45
Add summary of lockout policy.

Documents default settings. Fixes [#35577665].

Change-Id: I8baa2384b77be1b89cb7457b91edd2bc8a1a8594
Fixed the gem to set the target correctly and only when requested.

[#35638855]

Change-Id: Idb9b9c35a517191f752d3e206769f392f32d2c48
Unify endpoint return codes and message bodies

[#35432427] Remove references to old /User endpoint
[Fixes #35352691] All API endpoints should return JSON

Change-Id: I66940398991b7e642ec23c7103e51b918ffa6a6f
cfid-39: user id returned in the token to a user created by the login server

[Fixes #35642261]

Change-Id: I813a7f6cdd474d525ab6a0ea47cf14d2f3698fe9
[Fixes #35830651] [cfid-69] Runtime error in gem (frozen string)

Change-Id: Ibcd06b4c0f773a8192a6d632f03e066a21c1bd4d
[#35832353] [cfid-71] investigate cause of problem

- be defensive in the app sample too [#35831915]
- and use default scopes in browser client
- confirmed that the sample works with local UAA
- but not with local login server (even the sample app)

Change-Id: Iee33c49a78dc3ebea737ab6ab4cf1db7f0886f7a
[cfid-71] Add CORS filter to api sample

The issue is not to do with the login server specificially,
just that I was testing it with the api service in a different
domain than the app sample, so the browser common-origin
policy was preventing the xhr from completing (and giving very
little clue as to what was happening other than a pre-flight
OPTIONS request).

I added a filter to the api sample that I thought would fix it
but it hasn't.  Not really a super high priority to fix though.

[#35832353]: Fix implicit demo in app sample

Change-Id: I780786c60723fa0eb13e0a69c89dc75c9e6aaafe
Upgraded szxcvbn library to version 0.2

[Fixes #35625257]. Provides support for matching dates and digits, as
well as some minor bug fixes.

Change-Id: I580bbc91b6ddf8ff2fb7ecdfe38c716b1e9da999
support saml login server, separate token_endpoint

35825009

Change-Id: I875a946ccfeffccc5862f0f5a16d0e3cd5237e1b
Merge "support saml login server, separate token_endpoint" into develop
Support for user data at password strength endpoint.

[Fixes #35785273]. A "userData" parameter containing a comma-separated
list of user-specific words can be passed along with the password.
The words will be added to the standard dictionary search and any
matches will drastically reduce the password score.

Change-Id: Ibf52759ef74515ec3820e7b62e2a9c9146476db6
[cfid-76] Add explicit session creation flag to login security config

[Fixes #35917577]
Login server not getting session cookie on login authentication to /oauth/authorize

Change-Id: I689f616923e655549ecb1c55982839d2231becf6