Allow RT::Users->WhoBelongToGroups to optionally return unprivileged users

The WhoBelongToGroups filter should really not apply LimitToPrivileged at
all, but we can't remove it without breaking security assumptions elsewhere
in RT or in 3rd party code. So a new option IncludeUnprivileged is added, a
boolean that defaults to false. It can be set to true to disable the
LimitToPrivileged filter.

The documentation of the method is amended to explain that it filters out
unprivileged members by default.
Avoid "uninitialized value in eq" warnings on upgrades from 3.8

In 3.8, the Type parameter was never passed to SUPER::Create, leading to
all 3.8 databases having a NULL 'Type' column.  If upgrading to 4.0 from
3.8.8 or before, the 3.8.9 upgrade step is run with a 4.0 lib/ but a 3.8
database; the examination of ->Type in ->SetContent thus causes a
warning.

Explicitly set the type (to the default, Perl) before calling
SetContent, to avoid the warnings.  This does not confuse the later Type
upgrade step (in 3.9.1), as that updates Type = NULL rows, and only
aborts if it finds rows with Type != 'Perl'

Fixes issues #17505.
Allow arbitrary Content-Disposition in REST uploads

Fixes issues #19770
Save path because some installers or tests can change cwd

In cases where the CPAN installer fails to install GD and
its dependencies, the cwd can remain set to the directory
where GD was unpacked and tests were run like

  ~/.cpan/build/GDGraph-1.48-N0EX5K

When $0 is invoked later, rt-test-dependencies isn't found
because we're in the wrong directory.

The warning was masked in RT 4.0 because after the 'use'
to determine if Test::NoWarnings was installed, all warnings
were consumed by that module. This is fixed in RT 4.2 by ff15f21d3.
Prevent uninitialized warnings on search result pages with no query

Fixes issues #29699
Allow downloading dotfiles

Our directory-traversal code overzealously rejected requests for
/Ticket/Attachment/100/200/.bashrc and the like, making the "download"
links for uploaded dotfiles appear to return a blank page.

Allow /.something, but reject /./, /../, ../, /., /.., and the like.

Fixes issues #29700.
don't trigger default warning handler for inline servers

we already handle server warnings in StashWarnings middleware, so it's not
necessary to do so. without this, under TEST_VERBOSE=1 mode, those warnings
will be bubbled up to Test::NoWarnings handler, which could cause
Test::NoWarnings::had_no_warnings() to fail.
Add a method to remove a user preference
Add a "Reset" button to configuration of homepage portlets

This allows the user to reset to the search's defaults.
Remove HomepageSettings preference on "reset" to pick up global defaults

Ensure that the global settings for "RT at a Glance" are taken when a
user resets their preferences.  Previously, the setting was simply set
to an empty hash, which meant that the global defaults were not applied.

This causes the reset button to revert current session to the current
state of the global configuration, which is thereafter cached for the
duration of the session in $session{'my_rt_portlets'}.
Remove the session cache of the "RT at a Glance" portlet lists

The initial commit of "RT at a Glance" configurability (8b8e90d) added a
caching layer in the session, rather than hit the Attribute for the
preferences on each request.  Remove this caching, in order to ensure
that users who have not overridden the preference always get the most
recent global configuration.  This comes at the cost of an extra 1-2
Attribute queries on the front page, but as these are well-indexed, this
negligable performance impact seems worth it to obey the principle of
least surprise when the admin updates the global configuration.
Tests for user preferences
Merge branch '4.0/reset-rt-at-a-glance' into 4.0-trunk
Merge branch '4.0/upgrade-warning-from-3.8' into 4.0-trunk
Merge branch '4.0/save-dependency-script-location' into 4.0-trunk
I#22893 - Update mysqldump command on backups docs

When you set the option "--no-data" on the first command, then it should
*not* try and do a LOCK on the "sessions" table cause obvious you're not
going to get data. This bug was fixed only in mysql-server 5.6, so lets
just suggest adding "--single-transaction" no matter the version for
simplicity's sake.
remove diag call in RT::Test::file_content

the main reason to remove it is it causes t/web/cf_access.t to fail no
warnings tests under TEST_VERBOSE=1 mode. the warning is like:

    Name "RT::Test::TODO" used only once: possible typo at .../Test/Builder.pm line 2244

though we can also get around it by increasing $Test::Builder::Level in
RT::Test::file_content or never call file_content in compilation stage(e.g. in
a BEGIN block or "use constant ..."), imo it doesn't worth it.
Web installer: fix check for schema when installing to existing DB with no schema.
Merge branch '4.0/whobelongtogroups-unpriv' into 4.0-trunk
Correct ChartStyle value is 'bar'

The correct dropdown option for ChartStyle is 'bar', not 'bars'. This
was caught while trying to reproduce and find the source for I#29595,
but didn't raise any known issue until now cause the first listed
<option> is 'bar'.