All interactions and activity tags are reviewed to fix bugs like duplicated
root applied rules, and also reduces the amount of duplicated/useless work, e.g:
- Simulation trees are not expanded anymore when simulated objects are modified.
- 'expand' activities are merged (i.e. dropped) with any other 'expand' activity
  for an ancestor.
New implementation exposes new API that hides much complexity to the developper
about activity dependencies.

By default, expand() now automatically defers any work if the current
transaction takes too long time. This method also gains a parameter to
explicitely choose when to expand, which is often important in unit tests or
solvers. In particular, when postponing work, it takes care of setting proper
activity dependencies.
- If you have any code requiring to expand everything immediately, you'll have
  to replace 'expand()' by 'expand(expand_policy="immediate")'.
- On the contrary, you should replace any 'activate().expand()' by
  'expand(expand_policy="deferred")'.
expand() still accepts activity parameters for any extra needs.

In causality workflow, 'building' state is clarified and now means
« delivery may diverge but we can't know now ». A delivery remains in draft
as long as it does not contain any movement built from simulation.
After init/clone/builder/etc. scripts used to call 'startBuilding' &
'updateCausalityState': this calls must be removed since only
SimulatedDeliveryBuilder should take care of move to 'building' state and
workflows now triggers 'updateCausalityState'.

Disguised interactions have been unhardcoded and either deleted, or moved to
appropriate interaction workflows, which have been reorganized. Those
that triggers update of portal_workflow can be easily customized or disabled.

New API:
- updateSimulation() on deliveries and subscription items. It takes care of
  creating root applied rule, expanding and reindexing parts of simulation
  trees. It somehow replaces:
  - Delivery_updateSimulation
  - Delivery_updateAppliedRule
  - Delivery.applyToDeliveryRelatedMovement
  - Delivery.updateAppliedRule
  - Delivery.expand
  - Delivery.expandRuleRelatedToMovement
  - SubscriptionItem.expand
  - SubscriptionItem.updateAppliedRule
- Delivery.localBuild() is the new way to do local building and replaces
  Delivery_expandAndBuild. Private method Delivery._localBuild replaces
  Delivery_buildOnComposedDocument.
- Simulation Movements that are being built by a builder are reindexed with
  the following tag: 'built:<delivery_path>'. Any after_path_and_method_id
  dependency against 'related_simulation_movement_path_list' and reindexing
  methods should be replaced by this after_tag.

After builder scripts used to confirm the delivery in a separate activity,
which was useless.

If specified, <path> must be the path of an ancestor and SQLDict will merge all
similar messages under this path and process only the root message.

This will be used in ERP5 simulation to drop 'expand' activities that are
children of other 'expand' activities.

Because it can be used with grouped messages, it may be interesting to used it
for recursiveImmediateReindexObject.

This reverts commit 2a84df59 partially.
With a good index, requests should be fast enough to avoid locks.

Use following requests to update activity tables:

ALTER TABLE message DROP KEY processing_node_date, ADD KEY processing_node_priority_date (processing_node, priority, date);
ALTER TABLE message_queue DROP KEY processing_node_date, ADD KEY processing_node_priority_date (processing_node, priority, date);

Revert c9448903 (Delivery_afterClone will update  causality state after cloning).

real security configuration should still remain in sub module (modify 4610f372 a bit).

ref. http://comments.gmane.org/gmane.comp.web.zope.cvs/22117

ref. http://comments.gmane.org/gmane.comp.web.zope.cvs/22117

fix class tool's dtml files so that it works on Zope-2.12.23 too. also add some assertions to check if it works.

Revert "define __getitem__ instead of _getOb in class tool so that it works on Zope-2.12.23 too." that broke some tests.

This reverts commit 8670f40a.

Data can be really complex string, which can be bad for tag.

Use volatile cache to store tokens and one key per site.

Token server can be totally different then resource server.

Return token on addition.
Use proxied scripts to access whole system in order to allow unprivileged user
to manage own tokens.
Update roles immediately in order to give unprivileged user access to
validated token.

By requiring token_validation_method extraction plugin is only responsible
for low level implementation.

BearerTokenModule_addNewToken allows to add token for Person passed as
destination_reference. In case if Person has no key assigned new one is
generated.

BearerToken_isValid allows to validate token against (possibly) related person
object.

Base_getHMAC is low level interface to hmac module.

In order to made tokens unique use User-Agent and REMOTE_ADDR in token
generation body. Thanks to this token will be narrowed to one broswer. In order
to avoid reuse token on different servers add Host.

Key to generate HMAC are stored on Person object using bearer_token_key property.