[webui] move finding the request into a before_filter

(to please code complexity check)
[api] forbid direct access to _project/_attribute?meta=1

This is the route the backend gets the API attributes from, but the user should
not be able to write it directly
[backend] implement new full tree handling

Can be enabled by setting $BSConfig::new_full_handling. Handle
with care.
[backend] compare the scan time and not the building packages count when updating the mdload
[backend] improve appdata merging
[api] allow old-style patchinfos specifing a name inside of each _patchinfo file

also a allow to specify special updateinfo tags for each channel target.

internal change: updateinfo id will not be set by first package, but by first patchinfo
which gets released.
[backend] fix lastmeta comparison
[api] render json and not xml on /configuration.json route
[backend] give hint in what architecture a kiwi project is built
[webui] there is no meego project OBS anymore, but a Tizen one.
[dist] make production.log a ghost file, but ensure that it exists and has right permissions
[api] support special maintainerships in "_product" package containers (issue 477)
[webui] do not add the group users to the list of users

This is very confusion - fixes issue #500
[backend] support BSXML::frozenlinks, add verifyer
[backend] add experimental frozenlinks support

It can be used to "freeze" project links, i.e. fix the packages
and their srcmd5. Note that this feature may change in the future.
[webui] merge the existant comment titles into the body

Fixes issue 546 as discussed in 2.5 meeting
[webui] slim down the display of comments

Now that we have no titles, we can display the whole thing a bit more compact
[webui] don't reuse project list between users

Wrote test case for issue #272 and noticed something:
hidden projects were in cache as the cache only validated there were no updates
to the list, not if things were removed. That was of course very naiv to write.
[backend] fix verify_attributes function
[backend] allow chinese in attribute values

Anything else should be verified by the API not by the backend