Bumps [lodash](https://github.com/lodash/lodash) from 4.17.11 to 4.17.14. **This update includes security fixes.**
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.11...4.17.14

)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Improve dark theme handling in workflow apps

Use HTTP1.1 to read S3 objects

Adjust stale bot message

Prevent undefined offset 0 in findByUserIdOrMail

Fix files_automatedtagging settings

Some of the READs otherwise use HTTP/1.0 which is not always supported
by all backends. HTTP/1.1 is there since 1999 way longer than S3 so safe
to assume it is always there IMO.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Signed-off-by: Joas Schilling <coding@schilljs.com>

Signed-off-by: Joas Schilling <coding@schilljs.com>

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

Don't send executionContexts for Clear-Site-Data

Make it possible to wipe all tokens/devices of a user as (sub) admin

Stale bot message – Fix plural of information. Include that not every stale issue is missing information.

There are plans to remove executionContexts from the spec: https://github.com/w3c/webappsec-clear-site-data/issues/59

Firefox already removed it https://bugzilla.mozilla.org/show_bug.cgi?id=1548034

Chromium implementation is not finish: https://bugs.chromium.org/p/chromium/issues/detail?id=898503&q=clear-site-data&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified



Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

adding toggle password to be able to see it when login

Fix ProviderV1Adapter isAvailable wrapper

allow keeping multiple preview "versions" of the same file

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Add an event to edit the CSP

Bump marked to 0.7.0

Signed-off-by: Phie <phie@phie.ovh>

allow injecting CsrfTokenManager by class

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Ignore forbidden exception when fetching share mtime on SMB for symlinks

Signed-off-by: Robin Appelman <robin@icewind.nl>

Update babel deps

The main use case here is storage provided versioning where we dont have
separate file ids for all the versions, by allowing a prefix for the
version we can store separate previews for all the versions.

Additionally, by keeping all the version previews in the same folder as the
"normal" previews they will be cleaned up properly when the file is deleted

Signed-off-by: Robin Appelman <robin@icewind.nl>

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

See https://github.com/nextcloud/server/pull/7556#issuecomment-499028026



Signed-off-by: Morris Jobke <hey@morrisjobke.de>

This introduces and event that can be listend to when we actually use
the CSP. This means that apps no longer have to always inject their CSP
but only do so when it is required. Yay for being lazy.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Remove one time repair steps that have already run when updating to 17