api docs: more consistent use of space around ":" in examples

The examples are informal pseudo code - not json and not python. But let's try
to be consistent anyway.

auth: drop api_access_controllers_whitelist and give API key auth same access as other kinds of auth

All authentication methods are created equal. There is no point in
discriminating api key authentication and limit it to few APIs.

locking: drop the pull-to-lock / push-to-unlock functionality

The feature is not worth the maintenance cost. The locking is too coarse and
unflexible with insufficient UI and UX. The implementation is also quite
invasive in tricky areas of the code, and thus high maintenance.
Dropping this will enable other cleanup ... or at least make it easier.

repos: only allow api repo creation in existing groups

Fix problem with '../something' paths being allowed; '..' will always exist and
can't be created.

This also introduce a small API change: Repository groups must now exist before
repositories can be created. This makes the API more explicit and simpler.

This issue was found and reported by
Kacper Szurek
https://security.szurek.pl/

repos: only allow api repo creation in existing groups

Fix problem with '../something' paths being allowed; '..' will always exist and
can't be created.

This also introduce a small API change: Repository groups must now exist before
repositories can be created. This makes the API more explicit and simpler.

This issue was found and reported by
Kacper Szurek
https://security.szurek.pl/

api: add get_pullrequest and comment_pullrequest methods

Modified by Mads Kiilerich, mainly to let the test helper function
create_pullrequest use model directly.

api: add optional branches, tags and bookmarks information to get_repo API data

Modified by Mads Kiilerich to make these revision names optional - there can be
a lot of them.

Add JSON-RPC API for reading changeset status

Allows reading a changeset status as json. This is useful for e.g. reporting,
extracting review status for all changesets between two releases.

auth: improve API key documentation for users

Add a warning about API key implications on the actual My Accounts/
API keys page where users are likely to see it.

No warning is added to the admin page equivalent, under the assumptions
that admins can be trusted to either know what API keys are (or at least
not mess around with them when editing other users), and thus don't need
the admonishment.

auth: add support for "Bearer" auth scheme (API key variant)

This allows the API key to be passed in a header instead of the query
string, reducing the risk of accidental API key leaks:

Authorization: Bearer <api key>

The Bearer authorization scheme is standardized in RFC 6750, though
used here outside the full OAuth 2.0 authorization framework. (Full
OAuth can still be added later without breaking existing users.)

cleanup: use example.com for tests and examples

example.com is explicitly reserved for this purpose. Using that means
we won't accidentally hammer a real server or real email address if an
example value escapes into the wild, e.g. in an automated test.

The domain "kallithea.example.com" has been used throughout to refer to the
example Kallithea server.

docs: update example output and example server configs

kallithea-api example output was not up-to-date, and the text was a
little vague on whether you specify a hostname or a URL.

The Nginx example config has been updated to assume a Kallithea backend
server on localhost:5000, like the Apache example.

The redundant ServerAlias option was removed from the Apache example.

docs: consistent spacing around headings

Start out with 2 empty lines before/after for top level, decrease for deeper
levels.

api: check repo create permissions for update_repo and fork_repo as for create-repo

Close loophole for creating repos everywhere.

Tests by Thomas De Schampheleire.

docs: rework stuff

The existing docs were far from how we wanted it to be. There was so much to do
and it is not feasible to do that cleanup it in clean patches.

Instead, I took a sweep through the docs and changed what I thought could
benefit from a change: structure, examples, advices, language, markup, content,
etc.

api.rst edited online with Bitbucket
See bugid #847

locking API returns objects instead of string messages.

- it's now possible to easily parse the output of lock functions

api: don't report invalidated cache_keys after invalidating a repo

The keys are an implementation detail and is never relevant outside RhodeCode
internals and should not be leaked.

- Manage User’s Groups: create, delete, rename, add/remove users inside.
by user group admin.
In this case, a user's group can be owned by several people thru an owner user's group.

Some refactoring of naming, permission handling logic.
- remove some code duplicity as well as inconsistent naming

recursive forks detach
- added API attrs for option to delete or detach forks
- deleting repos with attached forks raises an special Exception

"Users groups" is grammatically incorrect English - rename to "user groups"

- and same story with "repositories groups"

This will only change the user facing texts. Names of files, modules, functions
and variables should be changed too.

API methods create_repo, fork_repo, delete_repo, get_repo, get_repos
can be executed by non-admin users ref #539

Default parameters are now also used for creating repos using API calls, and initial repo scanner
- added new parameters to API call to override defaults
- docs update
- repo_type is now optional as it's a part of defaults

return proper id from users_group
update api docs

created rhodecode-api binary script for working with api via cli
- created docs
- moved the backup script to bin folder

API, added delete_user method.
- create_user now also returns new user object data as get_user
- updated docs

#404 API extensions for showing permission for users
- added permissions to get_user function
- added last_login to get_user and get_users function
- modified custom JSON encoder to handle non standard python types, like set, OrderedDict, datetime, date

Api docs fixes
- return proper type instead of type_
- members return now also a type user or users_group

API docs improvement.
- added id to each INPUT params as it might be confusing for people that this param should always be there

API updates
- update_user will do lookup by userid param that can be id or username
- all params are required for update_user api call
- get_user/s will return ldap_dn param which is more correct

API changes
- added removed_user_from_users_group function
- fixed errors on wrong username
- normalized add/remove members from groups functions
- docs updates

#227 Initial version of repository groups permissions system
- implemented none/read/write/admin permissions for groups
- wrote more tests for permissions, and new permissions groups
- a lot of code garden, splitted logic into proper models
- permissions on groups doesn't propagate yet to repositories
- deprecated some methods on api for managing permissions on
repositories for users, and users groups

#344 optional firstname lastname on user creation
- on display fallback to username if both empty

fixes for release 1.2.4
- docs updates
- requires.txt file
- changelog

api review
- normalized parameters (repo_name, group_name)
- added return values to some create functions
- fixed docs
- fixed bugs of parameters mismatch on docs

implements #330 api method for listing nodes at particular revision
- improved filtering by files in file list

implements #329
- api function for adding a users_group into repo
- fixed found issues on API with missing params detection
- updated docs for api