Hotfix installation

Please make sure you consult the page Hotfix Installation Notes for any additional actions needed to complete the installation.

Main correction(s) provided

• Fixed an authorization bypass on the management stream cat endpoint.
• GET /api/v1/ext/Rendition called with an invalid number of arguments now returns 400 Bad Request instead of 500 Internal Server Error.
• HTTP sessions now get the configured session.timeout applied after login. Previously a session kept whatever inactivity interval it had before authenticating.
• Fixed SAML logout failing when the IDP only exposes an HTTP-POST SingleLogoutService binding.
• Fixed repository startup failures and subtype restriction errors for several system document types when nuxeo.subtype.restriction.enabled=true.

New Feature(s)

• Users, groups and group members can now be exported as CSV server-side via the new userCSVExport and groupCSVExport bulk actions on the user and group REST endpoints.