Hotfix installation

Please make sure you consult the page Hotfix Installation Notes for any additional actions needed to complete the installation.

Main correction(s) provided

• Fixed an authorization bypass on the management stream cat endpoint.
• GET /api/v1/ext/Rendition called with an invalid number of arguments now returns 400 Bad Request instead of 500 Internal Server Error.
• Fixed Descriptor.merge incorrectly keeping a removed nested contribution when no prior contribution existed for its id.
• Fixed RuntimeKeyValueStoreFeature not honoring the legacy RepositoryConfig#cleanup() granularity.
• HTTP sessions now get the configured session.timeout applied after login. Previously a session kept whatever inactivity interval it had before authenticating.
• Fixed SAML logout failing when the IDP only exposes an HTTP-POST SingleLogoutService binding.
• Fixed repository startup failures and subtype restriction errors for several system document types when nuxeo.subtype.restriction.enabled=true.
• Non-file-backed blobs are now properly handled by PDF utilities
• Fixed ILIKE searches returning no results for values containing non-ASCII characters such as diacritics.

Task(s)

• Audit route predicates can now query extended info fields, including nested keys.

Improvement(s)

• Fulltext blobs can now be stored under a seperate prefix in Azure and GCP storages.
• NXQL AND and OR now follow the SQL ternary truth table, so clause order no longer affects results.
• There is now a nuxeo.search.indexing.bulk.size.max property to limit the OpenSearch indexing request size, default is set to 10MiB