`npm ci` speeds up installs by using package-lock.json directly.
Note: it does not check the 'engines' property, that is only
done when adding or changing dependencies.

(cherry picked from commit 4d9dde92578c102482fab854854f357f45a5402d)

during a login attempt, whether successful  or not, the fallback session
is not required to be logged out. Also instead of calling #invalidateNow
during a login attempt to force a new http session, it makes more sense
to use #replaceSession which replaces the web session without destroying
all wicket components directly. An extra advantage is that we can override
replaceSession and then suppress the logging out of the fallback session

(cherry picked from commit 4d19226ceda397a03e3c893be1e9b154ad62b99f)

When original image used instead of scaled image in the scaling
operation, original image file on the file system won't be deleted.

(cherry picked from commit 06025da5)

When an image has been scaled to its original dimensions, image which
has the smaller weight when compared between original image and
scaled image will be used to be saved.

(cherry picked from commit bc45d293)

(cherry picked from commit aedad3e3)

Note this also backports also CMS-10946 due to conflicts otherwise. The
changes in CMS-10946 can be backported without problems

Avoid the possibility to exploit session fixation. After login, the
session id needs to be renewed. There are some if/else conditions
because when logging in into multiple webapps (cms and cms/console), it
is not always possible to renew the session since you would then be
logged out for the other app. Hence, the same credentials are allowed to
login into a second app without session invalidation. On localhost we
allow even different credentials to support being able to login into cms
and cms/console during development with different credentials.

(cherry picked from commit b1f02145)

The latest wicketstuff version for 6 is 6.28.0, which is used.

(cherry picked from commit 77e6ee6c)

REPO-2065

CMS-11245 [back port CMS-11136 to 11.2] same logic for "Save all" as for "Discard all" in order to not confusingly cancel documents on "Save all"

(cherry picked from commit b19acb38)

CMS-11245 [back port CMS-11136 to 11.2] properly handle document state on editor close for bulk tab actions

(cherry picked from commit f120d6ab)

No need to make it public.

(cherry picked from commit 8c757b66)

A backport of HHP-26. Plus a text change in a pom file.

(cherry picked from commit 9600a438)

While refactoring issue CMS 11063, a bug was introduced that allowed the
YuiDatePicker to be created with a null reference for its settings.
This in turn resulted in another null reference in the browser and a
broken scheduled (de)publish dialog.
Fixed by using the correct reference.

(cherry picked from commit 476b3919)

(cherry picked from commit 5dbf8229)

(cherry picked from commit 848b2085)