OmeroReader: core is a List, not an array
Secure RawFileBean against writes in read-only context

Once a user has read access for an original file object,
the `RawFileBean` does not prevent writing the file even
if the settings on the group would prevent modifying the
file in the DB. Despite the security constraints, this
also leads to corruption of the file metadata since the
size and sha1 are no longer trustable (since they can't
be properly updated).
Refactor PublicRepo for file security

On top of the previous commit which makes RFS beans
secure, this commit uses those RFS beans exclusively
from the `RepoRawFileStoreI` which is returned by
`PublicRepositoryI` as well as adds checks that files
are actually in the database before passing out
`RepoRFSI` instances. The value of canUpdate is
then propagated down to the `FileBuffer` to prevent
IO-writes if necessary.
Use sf.configureServant in favor of msg.setHolder

The addition of the holder field to RegisterServantMessage
was a leaky abstraction. Rather than requiring that API
usage, having the newly refactored method `configureServant`
called on the servant during message processing is much
cleaner and guarantees that the hard-wired AOP is applied.
Better SecVio handling in PublicRepositoryI

Since the public repositories don't have any AOP
magic (yet) to properly map exceptions, we need
to explicitly map from ome.conditions.* to
omero.ServerError subtypes, otherwise unknown
local exceptions will be thrown.

With this commit, the tests as TestManagedRepository
as it stands is passing but will need to be extened.
Read security for the list and listFiles methods

These methods now use the DB as the definitive
source of files to return to the client. In fact,
they don't check for actual existence of the files
at all.
Check parent dir on getOriginalFiles
Create ofiles during makeDir(path)

With these changes, makeDir() now creates intermediate
directories as objects in the database to make them
available for listings. Permissions on the created
objects are those of the current call context.

Note: there are still too many locations responsible
for creating original file objects in the DB. These
need to be refactored.
Refactor Dao to use CheckedPath as long as possible

Now, CheckedPath instances should be preferred over
strings in all RepositoryDao methods. These should
only be converted to path and name elements when
passing to SqlAction or similar.
Fix issues with CheckedPath being root

Various methods will need special logic to handle
when the passed CheckedPath instance is actually
the repository itself since its path and name values
then significantly vary. This may need to be
generally reworked.

The two private group tests are now passing.
Working read-only test with minimal fixes
Add read-write tests with no server changes
Refactor create*OriginalFile methods

There were 3 or more locations which were all
nominally responsible for creating original files.
These have now been refactored and simplified. This
was done as a way to provide a single location for
directory-write permissions.
Fix typo in exception
Refactor and improve directory creation

 * Check parent directories more consistently
 * Check mimetype more consistently
 * Move mkdir calls into RepositoryDao for txs
Make dirWrite an "annotate"-like action

Now in a rwra group, group members will be able
to add a file to a directory. Previously, this
was only possible in a rwrw group, but such a
group also permits modifying others' files.
Introduce StatefulWork interface for use with RepositoryDao

The access of the RawFileBean with one SimpleWork instance in
RepositoryDao.getRawFileStore was taking place in a separate
transaction from all the accesses by (Repo)RawFileStoreI. This lead
to the "flush()" statements of RawFileBean no longer properly saving
to the database.

In order to work around this, it was necessary to teach
SessionHandler how to detect that a StatefulWork instance was being
passed in, and then use that as the lookup key for finding the
appropriate session.

This isn't necessarily the best solution, but will work until we can
decide on an overall "stateful executor" strategy.
Fix utests/ManagedRepositoryITest.java
Refactor expandTemplate to use StrSubstitution

Since we will need to add a version increment into
the timestamp, more control over the parsing is
needed. Rather than expand getStringFromToken, I've
moved to using common-langs StrSubstitution.

Note: the Calendar instance NOW has been removed
in order to have timestamps reflect the actual
date after several days running.
Change template to %group%/%user% to reduce conflicts

Since we now check all the directories in a hierarchy
are accessible in the current context, having %user%
at the top means by force that there will be one user
directory per group that the user is in (user, user-1,
etc.). This defies the purpose of putting the user at
the top of the hierarchy.