Fixes #7401 - Add support for bonds

Renames physical_device to attached_to and move the virtual device
form out of BMC.
Extends the form for Bond devices
Allow configuration of bonds in KS template
Parsing of Bond interfaces from facts
Mac address is required only for physical devices
Fixes #4369 - Added link to filters page on RBAC form

Load filters table in roles UI via ajax
Fixes #5139 - leftovers subscribe_to_all_hostgroups

Remove user_xxx unnecessary tables and notices

Update subhostgroups removed

Fixes for migration of foreign keys

Remove users from compute_resource fixture

Remove table notices after fk are removed for pg/mysql
refs #7401 - fix markdown syntax in API doc
fixes #7876 - filter Organization.my_organizations by org, not locaion
Fixes #7884 - Display Fog errors on vm operation
Fixes #7886 - Compute Resources should be ordered by name
Fixes #7587 - Adds client-side password validation
i18n - extracting new, updating rails, pulling from tx
refs #7587 - precompile pwstrength JS, move gem from runtime deps
refs #7876 - my_organizations/locations tests
Fixes #7861 - Update rubocop version
fixes #7805 - Add several security related HTTP headers - security hardening.

This commit uses secure_headers gem and configures several HTTP
security related headers to be sent by server:
* Content Security Policy
* HTTP Strict Transport Security
* X-XSS-Protection
* X-Frame-Options
* X-Content-Type-Options
All of these enable browser protections on client side and make
exploitation of common web flaws harder.
Fixes #6214 - Alphabetical menu sorting in the UI
refs #7861 - remove trailing whitespace
fixes #7907 - Allow images from gravatar on secure headers
Refs #7587 -  Refactor password confirmation

* confirmation status is now linked to password field
* extracted additional missing strings
* simplified jquery selectors
* switched to onKeyUp built in event
* hide progress bar by default
* fixed minor css
* handle empty pw/confirmation
* moved javascript/stylesheet into partial instead of new/edit
* moved inline js to onContentLoad event.
fixes #6991 - API v2 - support unwrapped POST/PUT parameters even though it's not documented