Implement `passphrase.query` for querying credentials

Summary: Resolves T5868.  This implements `passphrase.query` and a mechanism for allowing Conduit access to credentials.

Test Plan: Tested locally.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: talshiri, epriestley, Korvin

Maniphest Tasks: T5868

Differential Revision: https://secure.phabricator.com/D10262
Don't render a grip on tasks returned over AJAX to non-draggable UIs

Summary:
Fixes T5140. When you ajax-edit a task and we send back a full-size card, we currently always put a drag grip on it.

If you clicked the "edit" thing from a priority-ordered list, this is appropriate. However, if you clicked it from some other type of list, it is not.

Pass the expected grippableness through the call.

Test Plan:
  - Edited a task from a reorderable (priority-ordered) view, got grip.
  - Edited a task from a nonreorderable (author-ordered) view, got no grip.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Maniphest Tasks: T5140

Differential Revision: https://secure.phabricator.com/D10282
Move notifications to ApplicationSearch

Summary: Ref T5891. This just modernizes infrastructure.

Test Plan: Viewed "All" and "Unread" notifications.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Maniphest Tasks: T5891

Differential Revision: https://secure.phabricator.com/D10281
Modernize DatePicker

Summary: Fixes T5893. Uses more standard colors / spacing / shadows / icons.

Test Plan:
pick dates

{F191310}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T5893

Differential Revision: https://secure.phabricator.com/D10285
Implement DestructibleInterface for dashboards and panels

Summary: Fixes T5471.

Test Plan: Used `bin/remove destroy` to destroy a dashboard and a panel.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T5471

Differential Revision: https://secure.phabricator.com/D10283
Provide a purchase detail view in Phortune

Summary: Ref T2787. This provides a purchase detail screen (which has nothing useful on it yet) and converts a bunch of PHIDs into slightly more useful links.

Test Plan: Browsed around my account.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T2787

Differential Revision: https://secure.phabricator.com/D10284
Add a Javascript method to find the pixel position of a range in a textarea

Summary:
Ref T3725. This might eventually allow us to do `@username` typeaheads in textareas.

Javascript!!!

Test Plan:
Dumped this into console and got a "<<<" at the caret position in Safari, Firefox and Chrome.

```
setInterval(function() {

var area = JX.$('comment-content');
var r = JX.TextAreaUtils.getSelectionRange(area);
var d = JX.TextAreaUtils.getPixelDimensions(area, r.start, r.end);

JX.log(d);

try {
  JX.DOM.remove(JX.$('ptr'));
} catch (_) {}

document.body.appendChild(
  JX.$N(
    'div',
    {id: "ptr", style: { position: 'absolute', left: d.start.x + 'px', top: d.start.y + 'px', zIndex: 9999, border: '2px solid red' }},
    '<<<'));
}, 1000);
```

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T3725

Differential Revision: https://secure.phabricator.com/D10280
Be more strict about "Location:" redirects

Summary:
Via HackerOne. Chrome (at least) interprets backslashes like forward slashes, so a redirect to "/\evil.com" is the same as a redirect to "//evil.com".

  - Reject local URIs with backslashes (we never generate these).
  - Fully-qualify all "Location:" redirects.
  - Require external redirects to be marked explicitly.

Test Plan:
  - Expanded existing test coverage.
  - Verified that neither Diffusion nor Phriction can generate URIs with backslashes (they are escaped in Diffusion, and removed by slugging in Phriction).
  - Logged in with Facebook (OAuth2 submits a form to the external site, and isn't affected) and Twitter (OAuth1 redirects, and is affected).
  - Went through some local redirects (login, save-an-object).
  - Verified file still work.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D10291
Audit - allow queries for "partial" and "accepted" audits

Summary: Fixes T5871. These queries get to use the actual column on the commit table since they are about the "aggregate" state of different audits.

Test Plan: issues queries and got sensible results.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T5871

Differential Revision: https://secure.phabricator.com/D10271
Paste - fix caching mechanism for S3-stored files

Summary: Fixes T5798. We basically weren't using the caching mechanism. Also adds service calls for S3 stuff, and support for seeing a little info like you can for conduit.

Test Plan: uploaded a paste, looked at paste list - no s3 service calls. edited the paste, looked at paste list - no s3 service calls and edited content properly shown

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T5798

Differential Revision: https://secure.phabricator.com/D10294
Fix external redirect flagging issue with image thumbnails

Summary: Fixes T5894. This needs some improvement when we lay in real CDN stuff, but should get all the cases right for now.

Test Plan: Thumbnails work properly again.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Maniphest Tasks: T5894

Differential Revision: https://secure.phabricator.com/D10299
Clean up image file diffs UI

Summary: Uses AphrontTable now, cleans up interactions. Fixes T5874, Fixes T4910

Test Plan:
tested a large image

{F192585}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T4910, T5874

Differential Revision: https://secure.phabricator.com/D10296
Remove localhost Drydock allocator

Summary: This has never been enabled by default, and isn't safe.  Remove it since people can use preallocated or EC2 hosts.

Test Plan: Removed it; didn't see it appear on the "Create Blueprint" page.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D10287
Support `bin/remove destroy Fnnn` for files

Summary: Straightforward (this is the one object type we do let you delete from the web UI) implemetation of `PhabricatorDestructibleInterface`.

Test Plan: Used `bin/remove destroy` to destory several files. Used `--trace` to verify they wiped file data.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D10300
Fix image scrollbars in Differential

Summary: This should be auto, not scroll (which always shows bars).

Test Plan: test my diff in a few browsers

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D10302
Cover redirects to files in more cases

Summary: Ref T5894. We have a couple more similar cases. Make them all do a decision-based redirect for now.

Test Plan: Did "View Raw File" and such, and also made sure thumbnails still work.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Maniphest Tasks: T5894

Differential Revision: https://secure.phabricator.com/D10301
Create an index on harbormaster_buildlog to reduce page load times

Summary: Resolves T5895.  This reduces page load times significantly when looking at builds.

Test Plan: Viewed a build, saw the page load a lot faster.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: epriestley, Korvin

Maniphest Tasks: T5895

Differential Revision: https://secure.phabricator.com/D10286
Send SMTP mail using quoted-printable encoding in all cases

Summary: See D10278. This works around a bug (?) in SendGrid, see http://stackoverflow.com/questions/6276181/extra-newlines-in-plain-text-emails-sent-via-sendgrid

Test Plan: @nickz confirmed this resolved his issue. See also D10278.

Reviewers: nickz, btrahan, chad

Reviewed By: chad

Subscribers: nickz, epriestley

Differential Revision: https://secure.phabricator.com/D10303