[backend] fix dclone call, it cannot clone non-refs
[api] Avoid finding forbidden info in full text search
[webui] Tests for searching forbidden packages
[api] fix /group/maintenance-opensuse.org
test HTML in the API
[api] move webui as into api engine