cleanup: get rid of most "import *"

Apply script generated with the following hack:
(
hg loc '*.py'|xargs pyflakes-2 | sed -rn "s/([^:]*):.*'(.*)' may be undefined, or defined from star imports.*/sed -ri 's,\\\\<\2\\\\>([^=]|$),XXXX.\2\\\\1,g' \1/gp" | sort -u
hg loc '*.py'|xargs pyflakes-2 | sed -rn "s/([^:]*):.* undefined name '(.*)'$/sed -ri 's,\\\\<\2\\\\>([^=]|$),XXXX.\2\\\\1,g' \1/gp" | sort -u
hg loc '*.py'|xargs pyflakes-2 | sed -rn "s/([^:]*):.*'(from .*)\.([^.]*) import \*' used.*/sed -ri 's,\\\\<XXXX\\\\.,\3.,g' \1/gp" | sort -u
hg loc '*.py'|xargs pyflakes-2 | sed -rn "s/([^:]*):.*'(from .*)\.([^.]*) import \*' used.*/sed -ri 's,\2\\\\.\3 .*,\2 import \3,g' \1/gp" | sort -u
) | grep -v kallithea/bin/kallithea_cli_ishell.py > fix2.sh

repos: make edit_permissions_revoke controller return an actual (empty) body on success

The code 204 was slightly confusing even though technically OK.

repos: add missing access control check for repository permission management

This issue was found and reported by
Kacper Szurek
https://security.szurek.pl/

repos: add missing access control check for repository permission management

This issue was found and reported by
Kacper Szurek
https://security.szurek.pl/

codingstyle: trivial whitespace fixes

Reported by flake8.

backend: replace Pylons with TurboGears2

Replace the no-longer-supported Pylons application framework by TurboGears2
which is largely compatible/similar to Pylons.
Some interesting history is described at:
https://en.wikipedia.org/wiki/TurboGears

Changes by Dominik Ruf:
- fix sql config in test.ini

Changes by Thomas De Schampheleire:
- set-up of test suite
- tests: 'fix' repo archival test failure
Between Pylons and TurboGears2, there seems to be a small difference in the
headers sent for repository archive files, related to character encoding.
It is assumed that this difference is not important, and that the test
should just align with reality.
- remove need to import helpers/app_globals in lib
TurboGears2 by default expects helpers and app_globals to be available
in lib. For this reason kallithea/lib/__init__.py was originally changed
to include those files. However, this triggered several types of
circular import problems. If module A imported something from lib (e.g.
lib.annotate), and lib.helpers imported (possibly indirectly) module A,
then there was a circular import. Fix this by overruling the relevant
method of tg AppConfig, which is also hinted in the TurboGears2 code.
Hereby, the include of something from lib does not automatically import
helpers, greatly reducing the chances of circular import problems.
- make sure HTTP error '400' uses the custom error pages
TurboGears2 does not by default handle HTTP status code
'400 (Bad Request)' via the custom error page handling, causing a
standard non-styled error page.
- disable transaction manager
Kallithea currently handles its own transactions and does not need the
TurboGears2 transaction manager. However, TurboGears2 tries to enable it
by default and fails, throwing an error during application initialization.
The error itself seemed to be harmless for normal application functioning,
but was nevertheless confusing.
- add backlash as required dependency: backlash is meant as the WebError
replacement in TurboGears2 (originally WebError is part of Pylons). When
debug==true, it provides an interactive debugger in the browser. When
debug==false, backlash is necessary to show backtraces on the console.
- misc fixes

tests: use test_context for tests needing internationalization (bis)

Commit 8e3137064ab6 already introduced the use of test_context to cover
internationalization in the test suite, instead of setting it up globally.

When making changes related to formencode internationalization, a new batch
of internationalization errors popped up and a commit was made to fix them.
However, after some later refactoring, it looked as if the commit was not
needed anymore.

In Turbogears context, it was indeed not necessary as long as we still had
some places that used the dummy formencode.api._ rather than a real version
of _ (ugettext).
After cleaning up that forgotten import, the test internationalization
errors popped up again. Hence, we need to reapply the earlier commit (with
some changes).

tests: add as little code as possible in __init__.py

kallithea/tests/__init__.py contained quite a lot of code, including the test
base class TestController. This in itself may be considered bad practice.

Specifically, this poses a problem when using pytest 3.0+, in which asserts
in some files are not automatically rewritten to give improved assert
output. That problem can be fixed by explicitly registering such files for
assertion rewriting, but that register call should be executed _before_ said
files are imported. I.e. if the register call is in
kallithea/tests/__init__.py, assert calls in __init__.py itself can not be
rewritten.

Since the TestController base class does effectively contain asserts, and we
do not want to execute the register call from somewhere outside the
kallithea/tests directory, we need to move the TestController class to
another file (kallithea/tests/base.py) so we can have a register call in
__init__.py before loading base.py.

While not strictly necessary to fix the mentioned pytest problem, we take
the opportunity to fully clean __init__.py and move everything to
the new kallithea/tests/base.py. While doing so, unnecessary imports are
removed, and imports are ordered alphabetically. Explicit imports of symbols
from modules that were already imported as a whole, are removed in favor of
fully qualifying the references (e.g. tempfile._RandomNameSequence).

tests: admin_permissions: split test_delete_ips from test_add_ips

While it is not necessary to be pedantic and split each assert in a separate
test, it makes sense to create separate tests for separate logical actions.
This makes it easy to understand from a test summary what works and what
doesn't.

Add and delete are deemed two such separate logical actions. The original
test_add_ips test did both add and delete, but was not even named to cover
this.

Note that the 'add' in the delete test is not the same as the 'add' in the
add test, i.e. for the delete test direct method calls are made instead of
passing through self.app.get/post (which is a higher layer of abstraction).

Background of this commit: during the Turbogears2 port, delete actions were
not yet functional, and 'test_add_ips' failed as a result even though 'add'
was perfectly fine.

tests: admin_permissions: make sure all custom IP permissions are cleared

test_add_ips changes IP permissions and at the end tries to clean up by
deleting it again. When the delete fails, there is still a restricted IP
permission configuration, causing other tests to fail.

Attempt a direct delete to the database without relying on the application
post/get interface.

tests: remove sleep hack to expire sql_cache_short

A number of tests sleep for 1.5 or 2 seconds to let the beaker cache
'sql_cache_short' expire. This cache is for example used for IP permissions;
tests changing such permissions need to make sure they take effect before
proceeding, especially when exiting from the test.

A much faster method is to effectively invalidating the caches.
Because it is difficult and fragile to only invalidate the relevant cache --
difficult to know exactly which cache needs to be invalidated, fragile
because the string indicating the cache line is not very nice and might
change in the future (in the case of IP permissions for the default user,
the cache is referred to with something like
"get_user_ips_default_Mapper|UserIpMap|users". This string changes when the
permissions are for a different user.

Clearing all caches shouldn't be a problem in a test context.

pytest migration: rename TestControllerPytest back to TestController

The name TestControllerPytest was introduced to allow a temporary situation
where nose/unittest and pytest-based tests could coexist.
This situation is now over, so the base test class can be renamed again.

tests: clarify user IP range test dependency on beaker caching of user objects

Requests with invalid request address would pass after configuring user IP
ranges because the IP range would not be validated as long as the user object
was found in the beaker cache.

Instead, wait until the beaker cache has expired and verify the user cannot log
in without a valid IP. Then provide a valid IP for later requests until the IP
range is removed again.

Based on original patch and research by Dominik Ruf.

pytest migration: convert simple functional tests to TestControllerPytest

Replace usage of TestController with TestControllerPytest for those files in
tests/functional where there is no setUp/tearDown method (the pytest
equivalent to be investigated) and that do not use test parametrization.

tests: provide _authentication_token when POSTing

So far not used, just preparing for the the time when the actual checking is
introduced ...

This change is very verbose. self.app.post should perhaps just at this value
automagically ...

Second step in two-part process to rename directories.
This is the actual directory rename.