* Switch from classpath to basis for license information

Previously we were chopping the classpath up and starting from there so
we just had a sequence of strings pointing at jars. Now using the basis
so we use a _much_ nicer map like

```clojure
{org.bouncycastle/bcprov-jdk15on
 {:mvn/version "1.70",
  :deps/manifest :mvn,
  :dependents
  [buddy/buddy-core
   org.bouncycastle/bcutil-jdk15on
   org.bouncycastle/bcpkix-jdk15on],
  :parents
  #{[buddy/buddy-sign buddy/buddy-core]
    [buddy/buddy-sign
     buddy/buddy-core
     org.bouncycastle/bcpkix-jdk15on
     org.bouncycastle/bcutil-jdk15on]
    [buddy/buddy-sign
     buddy/buddy-core
     org.bouncycastle/bcpkix-jdk15on]},
  :paths
  ["/Users/dan/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.70/bcprov-jdk15on-1.70.jar"]}
 ...}

```

So we now have a true name for the dependency, a path to it, and a
version. No need to string munge on the classpath.

* Read pom with `maven-model`

rather than us trying to parse the xml, use a maven model on it. Note
there is another level we can go to that would be aware of parent poms
but we don't need the overkill here. That's far heavier than what we
need to do in this instance.

Note this also reorders the algo:
previously
- license in jar
- backfill
- license from pom

Now:
- license from jar
- license from pom
- backfill

Possible we will want to actually just skip the license from pom bit
since it only gives us a name and a url and not the full text. We could
match on these and identify them with the resources used from the
backfill if we like.

Another important change is that this no longer throws if it cannot find
a pom for a jar. This came up for the following lib:

```
;; deps.edn
com.google.cloud.sql/postgres-socket-factory
{:mvn/version "1.6.0"} ; Secure Google Cloud SQL postgres connections

;; override:
"com.github.jnr"             {"jffi$native" {:resource "apache2_0.txt"}}
```
Which was from a 3rd party PR.

* Way to generate libs that need overrides

* Remove unused fns, add tests, cleanup docstring

* Don't leave tap> in

Two poms blow up with BOM errors

- jakarta.activation-1.2.1.pom
- jakarta.activation-api-1.2.2.pom

> UTF-8 BOM plus xml decl of iso-8859-1 is incompatible
> (position: START_DOCUMENT seen <?xml version="1.0" encoding="iso-8859-1"... @1:41)

It has a parent pom and not a license so we wouldn't find it anyways.

* dashboard api to get params value should return 404 instead of 500 when param not found

* on the 2nd thought, let's return 400

* update the tests too

* wording

* add parameters to report_card and card APIs

* make sure migration can work with existing cards and add migration tests

* remove debug code

* When parameters is empty, return template tag parameters

* update schema message

* update migraiton test name

* minor changes in test

* fix failing tests

* Always use card.parameters in PublicQuestion

* Add defaults and readd isEmpty check

* Default to undefined/use template tags in PublicQuestion...

* parameters should be in the writableProperties

* Native query card: construct parameters from template tags

* Separate the generation of parameter id

* Add parameter_mappings to report_card (#23003)

* add parameter_mappings to report_card

* fix from Noah's comments

* fix from Noah's comments

* Update a parameter from an updated template tag

* Correct the parameters construction

* Also add `parameter_mappings` to writableProperties

* CI test: bust the npm module cache

* Revert "CI test: bust the npm module cache"

This reverts commit 5a327b616f0220f43a90f7f871e0bd877ffa6f47.

Co-authored-by: Dalton Johnson <daltojohnso@users.noreply.github.com>
Co-authored-by: Ariya Hidayat <ariya@metabase.com>

Adds option to turn JSON column unfolding off. This does not constitute an actual fix of boat161 but flamber wanted it

* Adjust JWT and SAML fetch-and-update user to save new attributes

Before this change, JWT/SAML logins would attempt to update attributes, but never considered the first-name or
last-name attributes.

* Attempts to fix tests to prevent pulluting test users with "Unknown"

* No deleting users.

* Unit tests checking that first/last names are updated for SSO users

When an SSO user is first logged in, they might not have first_name and/or last_name keys. This is allowed, but the
names will be "Unknown" in the app-db. Subsequently, a User may log in again with SSO but have fisrt/last name
attributes, which should update the Metabase user data in the app-db.

These unit tests set up such a scenario to check that the :first_name and :last_name keys are indeed updated.

* Adjust Enterprise LDAP to also use SSO-UTILS

Trying to unify the LDAP implementation with JWT/SAML a bit here.

* Lint error

* Reverting LDAP ns changes to get the PR unstuck

This is to keep the ball rolling on SSO fixes. I'll add LDAP as an item in the Epic to address this separately.

Adding action button to Question Page

https://github.blog/changelog/2022-04-27-code-scanning-deprecation-of-codeql-action-v1/

Repro #22517: Adding/removing columns on an existing model will drop all configured metadata (#23071)

* Add new cache info types

* Add model cache info mock factory

* Add `checkCanRefreshModelCache` utility

* Handle new states on model page caching section

* Handle new states on Tools page

* Fix svg import type error

* Use "queued" for `creating` state

* Fix tests

* Update `SegmentedControl` variant style getters

* Add `fill-all` variant to `SegmentedControl`

* Fix `SegmentedControl` borders

* Make `TimeInput's` clear button optional

* Extract `useTimeInput` hook

* Add `CompactTimeInput`

* Add anchor time setting

* Only show anchor time if refresh interval >= 6 hours

* Show refresh time hints under the anchor input

* fix column settings ignored

* better fix

* Move caching logic out of FieldValuesWidget

* Try to clean up/centralize field value fetching

* Move dup logic to fetchValues

* Alwyas rely on option in component state

* Simplify hasList

* Make unit tests async

* Fix test import

* Fix outdated prop reference

* fix remappings

* Fix dashboard action unit tests

* sort filter fields

* add tests

* add e2e tests

* enable ellipsified test ids

* dont mutate sematic_type

An alert from trivy:

```
Package: com.google.code.gson:gson
Installed Version: 2.8.7
Vulnerability CVE-2022-25647
Severity: HIGH
Fixed Version: 2.8.9
Link: CVE-2022-25647
Trivy
```

running `clj -Sdeps` will not show this dep because it is in two
drivers. Instead running

```
clj A:ee:drivers
```

will find it.

```
. metabase/bigquery-cloud-sdk /Users/dan/projects/work/metabase/modules/drivers/bigquery-cloud-sdk
    . com.google.cloud/google-cloud-bigquery 1.135.4
      . com.google.code.gson/gson 2.8.7
```

and

```
  . metabase/googleanalytics /Users/dan/projects/work/metabase/modules/drivers/googleanalytics
    . com.google.apis/google-api-services-analytics v3-rev20190807-1.32.1
      . com.google.api-client/google-api-client 1.32.1
        . com.google.http-client/google-http-client-gson 1.39.2
          X com.google.code.gson/gson 2.8.6 :older-version
```

This shows: google analytics depends on 2.8.6 but it is not actually
used and bigquery-cloud-sdk depends on 2.8.7 which is the version that
we are ending up with. (The `X` means excluded from the jar with reason
being `:older-version`).

More info:

https://clojure.org/reference/dep_expansion#_tree_printing

```
Trees are built from the trace log and include all considered nodes. Included nodes are prefixed with .. Excluded nodes are prefixed with X. The end of the line will contain the reason code (some codes are suppressed). The current set of reason codes (subject to change) are:

    :new-top-dep - included as top dep (suppressed)

    :new-dep - included as new dep (suppressed)

    :same-version - excluded, same as currently selected dep (suppressed)

    :newer-version - included, newer version than previously selected

    :use-top - excluded, same as top lib but not at top

    :older-version - excluded, older version than previously selected

    :excluded - excluded, node in parent path excluded this lib

    :parent-omitted - excluded, parent node deselected

    :superseded - excluded, this version was deselected

```

THE FIX:

Just put a top level dependency on the version we care about. No need to
exclude the version. Technically only need it in one project as our
build would always use the specified version. But in case anyone builds
with just one or the other included in both for completeness with a
comment indicating the other location.

```clojure
com.google.code.gson/gson {:mvn/version "2.8.9"}
```

PROOF OF FIX:

clj -A:ee:drivers and look for gson

```
  . metabase/bigquery-cloud-sdk /Users/dan/projects/work/metabase/modules/drivers/bigquery-cloud-sdk
    . com.google.cloud/google-cloud-bigquery 1.135.4
      X com.google.code.gson/gson 2.8.7 :older-version
```

```
. metabase/googleanalytics /Users/dan/projects/work/metabase/modules/drivers/googleanalytics
    . com.google.apis/google-api-services-analytics v3-rev20190807-1.32.1
      . com.google.api-client/google-api-client 1.32.1
        . com.google.http-client/google-http-client-gson 1.39.2
          X com.google.code.gson/gson 2.8.6 :older-version
    . com.google.code.gson/gson 2.8.9
```

- 2.8.7 in bigquery-cloud-sdk now has an `X` and `:older-version`
- 2.8.6 in google analytics still has `X` and `:older-version`
- metabase/googleanalytics now has a top level (and included `.`) gson on 2.8.9

That is: collection, dimension, metric, native_query_snippet, pulse,
report_card, report_dashboard, report_dashcard, segment, timeline

Notably that doesn't include database, table, or field, since those all
have external unique IDs that are used instead.

* Include field annotations for native queries too

Persistence will replace a source-table source-query with a native
query, but preprocess has still filled in source-metadata with all of
the relevant field-ids expected to be returned. With this change we
include field info from the store in the same way that mbql-cols does.
This allows persisted models to honor field settings like `:visibility
:details-only`.

* Force type of merge-source-metadata-col to map

By doing the lookup to store/field at the top of the merge, the type of
annotations coming through was a FieldInstance. Tests, at least, were
unhappy about this and it's better not to change it.

* Resolve fields for ids in source-metadata

Makes sure that the qp/store has all the available fields for
annotations.

* Recursively find source-metadata field-ids for annotations

* Use transducer as per review

* fix login form mobile layout

* add padding

* Convert dashboard parameter utils to TypeScript

* Remove unused imports

* Convert parameter card utils to TypeScript

* Convert dashboard parameter utils to TypeScript

* Remove unused imports