* Remove `npm install` from steps

Allows `requestInterceptor` to add options to the curl command.
For example:

```js
requestInterceptor: function (request) {
  if (request.method === 'GET') {
    request.curlOptions = ['-g']
    request.url = request.url
      .replace('%5B', '[')
      .replace('%5D', ']')
      .replace('%2C', ',');
  }
  return request;
}
```

* Add default configuration `preserveAuthorization`

* Add localStorage to auth plugin

* Add persistAuthorization unit tests

* Refactor persistAuthorization to use wrapped actions

* Upgrade unit tests to be compatible with jest

* Add persistAuthorization documentation


Co-authored-by: Tim Lai <timothy.lai@gmail.com>

* docs: update setting-up.md with local dev

* config(jest): updated setup
* config(jest): update testMatch to include jsx files
* config(jest): add transformIgnorePatterns
* config(jest): update ignore files that do not work in jest yet
* config: add test:unit-jest to test script

* fix(jest): lint with eslint-plugin-jest

* refactor(jest): move unit test directory
* refactor(mocha): restore mocha tests that fail in jest

* docs(jest): update helpful scripts with test:unit-jest

* Update README.md
* Update setting-up.md
* Update plug-points.md
* Update plugin-api.md
* Update configuration.md
* Update deep-linking.md
* Update installation.md


Co-authored-by: Tim Lai <timothy.lai@gmail.com>

ref: #5311

Co-authored-by: AdrieanKhisbe <adriean.khisbe@live.fr>

* README updated
* renamed package.json to _sample_package.json
* removed package-lock.json

This commit changes markdown sanitization behaviour in following way:

class, style and data-* attributes are removed by default. These attributes
open possible vulnerability vectors to attackers.

The original behavior of sanitizer (before this commit) can be enabled by *useUnsafeMarkdown* configuration option.
Use this configuration option with caution and only in cases when you know
what you're doing.

* disabled on string values: "127.0.0.1", "localhost", "none"

* improvement: oauth "scopes" init parameter

* improvement: add "select all" and "select none" to oauth scopes popup

Co-authored-by: kyle shockey <kyle.shockey1@gmail.com>

Co-authored-by: kyle shockey <kyleshockey@gmail.com>

* Add PKCE support.

* Fix tests

* Update oauth2.md

* Rename usePkce

* Fix the BrokenComponent error

* Update oauth2.md

* Remove isCode variable. Remove uuid4 dependency.

* Remove utils functions

* Import crypto

* Fix tests

* Fix the tests

* Cleanup

* Fix code_challenge generation

* Move code challenge and verifier to utils for mocks. Update tests.

* Mock the PKCE methods in the utils file properly.

* Add missing expect

* use target-method spies

* Add comments to explain test values.

* Get rid of jsrsasign.

When `git clone` -ing from github, `https` URLs are (as far as I know) functionally equivalent yet less error prone.

Tense correction and clarity on line 44.

* Change Swagger-UI -> Swagger UI in docs

* Changed back to SwaggerUI in places that refer to JS construct

* add `security-audit` script

* npm audit fix

* remove nyc

* nightwatch@1

this breaks the test suite, but it appears to have already regressed. leaving it for another day, TODO: open a backlog ticket

* add `security-audit` script

* disable mocha exclusivity

* update package-lock.json

* cypress@3.4.0

* `npm audit fix`

* @release-it/conventional-changelog@1.1.0

* release-it@12

* Add the withCredentials configuration key

It enables passing credentials in CORS requests. e.g. Cookies and
Authorization headers.

* Improve withCredentials documentation

* Add unit tests for the withCredentials config

* Update configuration.md

* Update configuration.md

* only set `withCredentials` Fetch flag if the config value is truthy

there are some workarounds in the wild today that involve setting `withCredentials` on `system.fn.fetch` directly. 

this approach avoids mangling those existing workarounds!

* add more test cases

* Update configs-wrap-actions.js

* Update index.js

no PR too small!

* add `onFound` callback to schemas
* add warning to method docs (for #4957)
* implement Docker OAuth2 init block support
* update docs
* add OAUTH_SCOPE_SEPARATOR
* drop OAuth env from Dockerfile and run script
* don't indent the first oauth block line
* drop unused `dedent` import
* touch up warning message
* add more test cases
* return an empty block if no OAuth content is generated
* fix broken doc line

* reorganize docker things

* Configurator WIP

* implement Docker runtime config generator

* add tests

* update documentation

* fix Markdown tables

* Move Docker section

* add note to README

* move up `nodejs` install for more aggressive caching

* drop exclusive test

* fix missing `DISPLAY_OPERATION_ID`

This allows referencing a configuration parameter directly when responding to tickets or from within the documentation.

escape `|`

* Updated 'urls' (An array of API definition objects) description.

Updated 'urls' (An array of API definition objects) description to show an actual object array containing two (2) urls, clarifying this configuration-option.

* urls is an array, not a string

* extend getExtensions

Add optional param to getExtensions that can retrieve more stuff

* Add getCommonExtensions

* Trim trailing spaces

* Remove unused parameter

* Move the format inline with the param type

* correction to UnitTest

The 5# do not show well on the wiki but 4# do and they were not used

Operations is lowercase, without this fix the example doesn't work as a Copy/Paste

* docs: add async interceptor documentation

* Update configuration.md

* feat: swagger 2.0 preauthorization methods
* tests: add cases for oas3 preauthorization
* docs: add new preauth docs; touch up existing auth docs
* tests: add `rootInject` tests
* docs: remove unfinished sentence

* feat: `onComplete` config option

* tests(e2e): add case for onComplete option

* Use `parameterWithMeta` to get parameter data in <ParameterRow>

* Prefer specPath when fetching resolved subtrees in OperationContainer

* Add test for OAS3 callback rendering

* Remove debugger statement

* Pass base resolution URL directly to Swagger-Client subtree resolver

* Remove accidental comment

* Migrate additional options

* Don't default to empty Map when getting subtree

* fix(validateParam): check for ImList type before using count method

* Use `replaceState` to update `urls.primaryName`

This gives us the stateful URL we want, without:
(a) refreshing the page on update
(b) creating a long, useless history for the user
(c) implying that browser history is two-way bound
    to Swagger-UI (it isn't, we don't have a router)

* Add `fn.opsFilter` docs and internal API versioning note

* restrict `x-example` functionality to Swagger 2.0

* polish Authorize + Close buttons

* add tachyons; use it for padding the new Reset button

* v3.12.0

* rebuild dist