Use setuptools instead of distutils for extension packaging.

The extension packaging code was using distutils's classes instead of
setuptools's, which prevented more advanced features like MANIFEST.in
rules from being used. A simple import change fixes this.

Reviewed at https://reviews.reviewboard.org/r/5876/
Set a TRACKING_BRANCH for release-0.8.x in .reviewboardrc.
Release Djblets 0.8.1.
Bump to 0.8.2 dev.
Add a LocalDataQuerySet for using generic data in WebAPIResource.

This introduces LocalDataQuerySet, which operates similarly to a
QuerySet, but can store any iterable data. The interface it exposes is
similar enough to QuerySet for basic usage.

While this may be useful for various purposes, it's largely intended for
use with WebAPIResource. Before now, getting WebAPIResource to return
data not from a database was tricky. You had to rewrite the
serialization functions, get(), get_list(), etc. Now, get_queryset() can
return a LocalDataQuerySet, passing in whatever it needs, and
WebAPIResource will work with it.

Reviewed at https://reviews.reviewboard.org/r/5880/
Add support for custom paginated responses in API resources.

WebAPIResource now allows subclasses to set `paginated_cls` to a
subclass of a WebAPIResponsePaginated. This will be used for handling
the pagination of the resource's queryset and for serializing the data.

WebAPIResponsePaginated has been fully restructured to make its behavior
customizable. Subclasses can override nearly every aspect of it,
including previous/next calculation, URL building, results fetching,
link building, etc. This makes it possible to do such things as paginate
by SHA1, or by page (instead of result item index), or fetch data from
something other than a database-backed queryset.

Reviewed at https://reviews.reviewboard.org/r/5895/
Split djblets.webapi.core into smaller modules.

Over time, djblets.webapi.core has grown, and contained classes better
suited for other modules. We even had a circular dependency due to the
way that things were split up.

This splits out all the encoder-related classes and registration logic
into the existing encoders.py, and all the response classes into
responses.py.

The existing djblets.webapi.core will emit a DeprecationWarning, but
will continue to work as before.

No logic has changed, with the exception of changing old-style
`MyParent.function(self, ...)` calls to use `super()` instead.

Reviewed at https://reviews.reviewboard.org/r/5899/
Speed up unit tests for projects that use extensions.

Projects supporting extensions that used the test HTTP client would end
up reloading all extensions, creating RegisteredExtension entries, every
time a request was performed. This added up quite a bit over time.

This change does two things to address this problem.

1. The RegisteredExtension creation code has been improved. Instead of
   using get_or_create, we attempt a create and fall back on a get. This
   chops the number of queries in half, since we no longer are assuming
   there's an entry in the database already (which is a bad assumption,
   since earlier in the function, we checked and didn't see any).

   While here, I also fixed a bug where the wrong value was being
   used for the stored extension name, due to a scoping issue.

2. ExtensionsMiddleware no longer performs expiration checks if
   settings.RUNNING_TEST is True. It's up to the projects to set this
   for the test run, though.

Reviewed at https://reviews.reviewboard.org/r/5905/
Cache object lookups in WebAPIResource.get_object.

It's pretty common for different parts of a WebAPIResource subclass to
perform a get_object() call either on itself or on another resource.
This will happen in get_queryset() and in the permission-checking
functions. These checks are time-consuming and result in excess
database queries.

The built-in get_object() now supports caching of these objects. The
caches are tied to the request, so any redundant get_object() calls
taking place within that request will just use the original call's
result.

Reviewed at https://reviews.reviewboard.org/r/5906/
Include .less files in builds.

The .less files were missing from sdist and bdist_* builds, causing
issues when rebuilding media or when other files needed to reference a
.less file.
Release Djblets 0.8.2.
Merge tag 'release-0.8.2' into release-0.8.x
Fix reloading of logging settings.

restart_logging() wasn't properly reloading the logging settings. It
didn't know about all the handlers that were set, meaning the previously
registered ones wouldn't be reloaded. This led to duplicate log messages
with every attempt to reload.

It now unregisters every single log handler before re-adding them.

Reviewed at https://reviews.reviewboard.org/r/5934/
Fix a XSS vulnerability with bad input to json_dumps.

Django's JSON serialization does not handle escaping of any characters
to make them safe for injecting into HTML. This allows an attacker who
can provide part of a JSON-serializable object to craft a string that
can break out of a <script> tag and create its own, injecting a custom
script.

To fix this, we escape '<', '>', and '&' characters in the resulting
string, preventing a </script> from executing.
Fix a XSS vulnerability in the gravatar template tag.

The generated gravatar HTML wasn't handling escaping of the display name
of the user, allowing an attacker to choose a name that would close out
the <img> tag and inject a <script> tag.

Django 1.4 does not include format_html(), so instead, we just call
escape() on every value going into the HTML.
Fix running the webapi unit tests on Python 2.5.
Release Djblets 0.7.30.
Fix a XSS vulnerability with bad input to json_dumps.

Django's JSON serialization does not handle escaping of any characters
to make them safe for injecting into HTML. This allows an attacker who
can provide part of a JSON-serializable object to craft a string that
can break out of a <script> tag and create its own, injecting a custom
script.

To fix this, we escape '<', '>', and '&' characters in the resulting
string, preventing a </script> from executing.
Fix a XSS vulnerability in the gravatar template tag.

The generated gravatar HTML wasn't handling escaping of the display name
of the user, allowing an attacker to choose a name that would close out
the <img> tag and inject a <script> tag.

By switching to Django's format_html(), we can guarantee safe escaping
of content.
Merge branch 'release-0.7.x' into dev-0.8.3