Phase 1 add/delete is the best call spot for this as it
defines a "physical" connection.

This wasn't completely right before, trying to plug into rules
reload paths and caused issues with people adding/deleting their
OpenVPN devices, but the rules tab not properly indicating this
since OpenVPN has become a pluggable interface.

(auth, totp) isolate TOTP functionality into a trait, refactor LocalTOTP. all needed for https://github.com/opnsense/core/issues/1030

(model, fieldtypes) add update only text field type, closes https://github.com/opnsense/core/issues/1045

(status_gateway_groups) show missing gateways and status "monitoring disabled", for https://github.com/opnsense/core/issues/1132

(openvpn) add "Use common name" option to control username-as-common-name, closes https://github.com/opnsense/core/issues/1154

Suggested by: @fabianfrz

Suggested by: @Antonio-Prado

Now always restore from a full backup only, the standard has already
been switched in the scope of this ticket a while back.  The section
restore could be improved, but it's not really worth doing this in
the old code anymore.  Hopefully the last change of its kind here.

(legacy, config) add legacy glue for toArrayFromFile() into load_config_from_file, closes https://github.com/opnsense/core/issues/1097

(model) refactor getConstraintValidators() in BaseField, add getConstraintByName() to retrieve a constraint by name/key and add functionality to explain the model field relations.

Using reference tags in the constraints section its possible to tell the model which fields interact to avoid the need for a full model validation after each change.
For example if fieldA has a constraint which relates to fieldB, the latter can add a reference to trigger validation when only fieldB changes.

<Constraints>
   <check001>
     <reference>fieldB.check000</reference>
   </check001>
</Constraints>

While we don't exactly know how this pans out, it's code that needs
to be inspected by forcing it to -devel for a while.  As far as I
can see, the following applies:

When there are no gateways, they are generated as defaults.

When they are edited, they stay in the config and their e.g.
choice of being disabled should be honoured.

(model) skip save on migration when defaults lead to inconsistent data, closes https://github.com/opnsense/core/issues/1149

(theme) switch font to https://github.com/adobe-fonts/source-sans-pro/releases/tag/2.020R-ro/1.075R-it

for https://github.com/opnsense/core/issues/1104

When using opnsense_standard_table_form on a table, the first visible row contains a top border (because the invisible mobile border is placed first).
The change sets border-top-width on the first td,th to 0px and swaps the zebra printing to keep things more consistent.

Suggested by: @fabianfrz

At least FortiGate doesn't like meshing the phase 2 entries so
instead isolete each phase 2 entry in its own tunnel.  This is
supposedly IKEv1 trickery, but it works...

Also see: https://wiki.strongswan.org/projects/strongswan/wiki/FAQ#Multiple-subnets-per-SA
Also see: https://lists.strongswan.org/pipermail/users/2013-March/004478.html