fixes #7805 - Add several security related HTTP headers - security hardening.

This commit uses secure_headers gem and configures several HTTP
security related headers to be sent by server:
* Content Security Policy
* HTTP Strict Transport Security
* X-XSS-Protection
* X-Frame-Options
* X-Content-Type-Options
All of these enable browser protections on client side and make
exploitation of common web flaws harder.
Fixes #6214 - Alphabetical menu sorting in the UI
refs #7861 - remove trailing whitespace
fixes #7907 - Allow images from gravatar on secure headers
Refs #7587 -  Refactor password confirmation

* confirmation status is now linked to password field
* extracted additional missing strings
* simplified jquery selectors
* switched to onKeyUp built in event
* hide progress bar by default
* fixed minor css
* handle empty pw/confirmation
* moved javascript/stylesheet into partial instead of new/edit
* moved inline js to onContentLoad event.
Fixes #7879 - Update fog to 1.24.0
Fixes #2283 , #3135 - add config option for proxy_request_timeout
fixes #7332 - Host Create API documentation missing required parameters
fixes #3492 - API v2 nested routes for each controller
fixes #7584 - add Authorizable module to class AuthSource
Fixes #7934 - Set correct order of require_dependency
fixes #7372 - API v2 - accept PUT/POST requests with wrapped root node to add/remove has_many associations of child nodes
Fixes #7933 - OS api responses miss field title
fixes #4439 - ensure user logins are handled case insensitively
fixes #7898 - ensure that format can respond to json / yaml
fixes #7985 - add support for ws:// in secure headers
Fixes #7830 - interfaces api output is class specific

- per type rabl templates
- fixed api docs for interfaces
fixes #7331 - delete unassigned os default templates
i18n - extracting new, updating rails, pulling from tx
Refs #6549: Ensure tests to skip exist to avoid too deep stack.