ref: #5311

* improvement: oauth "scopes" init parameter

* improvement: add "select all" and "select none" to oauth scopes popup

* add `security-audit` script

* npm audit fix

* remove nyc

* nightwatch@1

this breaks the test suite, but it appears to have already regressed. leaving it for another day, TODO: open a backlog ticket

* add `security-audit` script

* disable mocha exclusivity

* update package-lock.json

* cypress@3.4.0

* `npm audit fix`

* @release-it/conventional-changelog@1.1.0

* release-it@12

* `test/e2e` -> `test/e2e-selenium`

* add Cypress

* ESLint fixes

* MOAR cypress

* `integration` -> `tests`

* wire Cypress up to a hot e2e server

* linter fixes

* don't run in CI

Remove usage of Google Fonts to avoid any data protection issue. Using a
CDN will leak data to a third party that can be simply avoided by using
system fonts instead.

Furthermore the usage of CDNs can cause legal issues in EU countries.

* feat: `onComplete` config option

* tests(e2e): add case for onComplete option

This change separates:
the Model (the one on the model-example section)
from
the Models (the ones at the bottom)

server test json files via webpack-dev-server

Fix #1598