We have a function pair rrd_import() / rrd_export() now, which do
wildly different things even though they've been used for a single
purpose:

(1) rrd_export() writes a string, appends it to the config.xml

(2) rrd_import() takes a parsed config portion, but not as an
    argument, rather as a global config element

(3) There was also an older backup clue which exported files, but
    simply packed them up for restore after boot

If we can get the system to unify the usage we'll end up with a
neat way of backing, restoring and migrating RRD data, although
I'm not sure if this can be fully compatible with the old files.

(cherry picked from commit c7a488dc)

(cherry picked from commit 802157a3)

PR: https://lists.opnsense.org/pipermail/devel/2017-March/000012.html
(cherry picked from commit 264c5655)

(cherry picked from commit e52e251e)

PR: https://lists.opnsense.org/pipermail/users/2017-March/000062.html
(cherry picked from commit a2381e6c)

(cherry picked from commit 88787945)

The admins group has this now, it makes more sense there as several
people ran into the issue of "my user is admin, but cannot login".

Besides, the privilege sets /bin/csh as the user shell, which we don't
use for root as we have /usr/local/etc/rc.initial there.

(cherry picked from commit 92fab652)
(cherry picked from commit 3a7f8310)

(cherry picked from commit f3c0f74f)

(cherry picked from commit 5ba281e8)

(cherry picked from commit 7504bd00)
(cherry picked from commit 465cd35a)
(cherry picked from commit 867a9a95)

(cherry picked from commit b6c6eec2)

(cherry picked from commit 200bd3ee)
(cherry picked from commit 1464b111)
(cherry picked from commit 8ba7da8f)

(cherry picked from commit b3c76778)

https://github.com/opnsense/core/issues/1483

(cherry picked from commit 66de2bde)

(cherry picked from commit 852261b6)

(cherry picked from commit 0995f558)

(cherry picked from commit 4388146c)

(cherry picked from commit 50b5de04)
(cherry picked from commit 2cf06c64)

(cherry picked from commit 2407fa01)

(cherry picked from commit cbea88de)

(mvc) csrf protection, not very likely to hit in normal situations, but when using legacy free applications, there might not be a csrf token leading to a denial of all requests.

(cherry picked from commit 29e3bb3e)

(cherry picked from commit 50f2ffad)

(cherry picked from commit dd2a605d)

PR: https://forum.opnsense.org/index.php?topic=4682.0

(cherry picked from commit 844d6b50)
(cherry picked from commit b8c9eb47)
(cherry picked from commit 2d03d196)

(cherry picked from commit ea0eeadf)

(cherry picked from commit 72e46245)
(cherry picked from commit 83b5aae6)

(cherry picked from commit 9821d6fb)