(model) refactor getConstraintValidators() in BaseField, add getConstraintByName() to retrieve a constraint by name/key and add functionality to explain the model field relations.

Using reference tags in the constraints section its possible to tell the model which fields interact to avoid the need for a full model validation after each change.
For example if fieldA has a constraint which relates to fieldB, the latter can add a reference to trigger validation when only fieldB changes.

<Constraints>
   <check001>
     <reference>fieldB.check000</reference>
   </check001>
</Constraints>

While we don't exactly know how this pans out, it's code that needs
to be inspected by forcing it to -devel for a while.  As far as I
can see, the following applies:

When there are no gateways, they are generated as defaults.

When they are edited, they stay in the config and their e.g.
choice of being disabled should be honoured.

(model) skip save on migration when defaults lead to inconsistent data, closes https://github.com/opnsense/core/issues/1149

(theme) switch font to https://github.com/adobe-fonts/source-sans-pro/releases/tag/2.020R-ro/1.075R-it

for https://github.com/opnsense/core/issues/1104

When using opnsense_standard_table_form on a table, the first visible row contains a top border (because the invisible mobile border is placed first).
The change sets border-top-width on the first td,th to 0px and swaps the zebra printing to keep things more consistent.

Suggested by: @fabianfrz

At least FortiGate doesn't like meshing the phase 2 entries so
instead isolete each phase 2 entry in its own tunnel.  This is
supposedly IKEv1 trickery, but it works...

Also see: https://wiki.strongswan.org/projects/strongswan/wiki/FAQ#Multiple-subnets-per-SA
Also see: https://lists.strongswan.org/pipermail/users/2013-March/004478.html

This reverts commit f85e688c.

Filter URL Only at HTTPS Filter

Prodded by: @fabianfrz

This is especially useful for "sudo su" in manually created admins
to gain access to the console menu without compromising the root
password.

Needs more fixing/unification with the proper way of doing it,
but for now let these strings trickle through the translation
machinery for maximum effect.

We don't have to do anything here anymore.  Since we started using
pkg(8) the extensions.ini was always consistent, but we needed to
make sure that the order is correct.  Some more cleverness was added
to no prevent other PHP modules from simply "plugging in", but since
they are not in one extensions.ini anymore it won't matter.

Expecting some splatter during upgrade, but hopefully also no more
php-suhosin clashes with php56-session not loaded.  :)