Switch to using friendly_id for product permalink generation

It's better for other people (who know better) to maintain at least some of the permalink generation code than for us to do it.

Old permalinks will still function correctly.

Proposed fix for #4167 + others
Improves Api::ProductsController#create

Conflicts:
	api/spec/controllers/spree/api/products_controller_spec.rb
Remove variants from permitted_product_attributes

Since Product don't use nested_attributes rails feature for variants
anyway. Plus add some more tweaks to make sure it's possible to pass
either a hash of variants or of option types when creating a product.
Find or create shipping_category on api/products#create

Users can send a shipping_category string on the product payload and
spree will find or create that shipping_category and associate that
category with the product. e.g.

    product: {
      ...
      shipping_category: "Free Shipping Items"
    }
Include display_price in variant return results
using completed_at rather than created_at for more accurate sales total report

Fixes #4205
Ensure that a deleted product can still be viewed in the admin backend
Remove unnecessary include for variant in inventory_units for Shipment#to_package
Add missing backtick for Core's changelog
set default for api config require_authentication back to true.

skip filters on frontend for coupon_code bypass the require_authentication setting on backend specs.

Signed-off-by: Peter Berkenbosch <peter@pero-ict.nl>

Fixes #4165
typo on spec_helper template for extensions

Fixes #4247
[backend] Fix fields used in reports_spec test
Add mention of friendly_id changes to core/CHANGELOG
Fix a couple of Order#is_risky bugs

Fixes #4261
Fixes #4260
[api] Handle adding option types to an existing product
[api] Allow existing variants to updated
Move report order criteria view to backend + fix translations
make sure the options are actually created.

Fixes #4271
Fixes #4273

Conflicts:
	backend/app/assets/javascripts/spree/backend/stock_transfer.js.coffee
[api] Do not run milliseconds precision on MySQL because MySQL does not do milliseconds
[backend] Fix issue where credit card payments were not transitioning

Fixes #4276
Fixes #4277

Conflicts:
	backend/app/controllers/spree/admin/payments_controller.rb
	backend/spec/features/admin/orders/payments_spec.rb