Upgrade to Django 1.11 (latest LTS)

[EnTeQuAk]

• Figure out if it's reasonable to directly jump to 1.11
• Especially since Django 1.9 is already out-of-live this is worth trying to skip upgrading to a potentially insecure version
• Check compatibility of our 3rd party libraries against Django 1.11 and patch accordingly
• Fix DeprecationWarnings ahead of the upgrade
• Remove jingo
• Remove jingo-minify / move it into our codebase
• Fix core stuff (translations, transforms, cache-machine, etc)
• Fix widget-based stuff broke because of the introduction of template-based widget rendering (whic broke private APIs we're using)
• Fix everything else (most notably Move zh-tw and zh-cn locales to zh-hant and zh-hans, respectively #4515)

[diox]

Leaving assigned for this week but I'm pausing work on this because I'm kinda stuck. Translations are half-broken because of a change in django that cause getattr(instance, 'name_id') and similar calls to try to fetch the FK object instead of just returning the FK value (i.e. the integer). The translations app relies heavily on the old behaviour to avoid extra queries etc and figuring out a proper fix is not trivial.

Also broken are all widgets that need custom rendering, those were using private APIs that have changed with the introduction of template-based widgets rendering. This is more straightforward to fix, just tedious.

[diox]

Random note I just discovered: https://docs.djangoproject.com/en/1.11/ref/settings/#std:setting-CSRF_USE_SESSIONS, which is new in 1.11, allows us to remove django-session-csrf dependency.

[EnTeQuAk]

Note on that, I started doing that in the django 1.11 branch but https://github.com/mozilla/django-session-csrf/blob/master/session_csrf/__init__.py#L144-L171 needs to be reimplemented to some degree as far as I can tell. still investigating, didn't look into that too deeply for now.

[bqbn]

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1434466 about a security issue in Django v1.11.

CC'd you there as well.

[EnTeQuAk]

I'm unassigning myself from this for now, I won't have time to work on this during the next two weeks I think. I'll re-assign this once I manage to get to it again.

[EnTeQuAk]

Started working on this again, full speed ahead towards Django 1.11!

[EnTeQuAk]

Clearing milestone for now to avoid moving this every week again and again.

[EnTeQuAk]

QA: Marking this as qa: extra because this PR updates Django, our base library that lays the foundation of addons-server.

So, please make sure, that:

• Your regular smoke tests work just fine (Login, Logout, Register, Upload an Add-on)
• Translations still work (Editing them in an Add-on, seeing them in the frontend etc)
• Forms generally work - that's only relevant for the legacy frontend
• Everything that comes to mind… The changes touch our base foundation but most of the relevant changes are on our translations-framework, some on devhub and a few more on our legacy pages but generally throughout the place

Please let me know if you have any questions about that.

Thanks a lot!

This is currently on -dev and will head to -stage next Tuesday targeting a deployment next Thursday (2018.07.19)

[vcarciu]

After another round of testing on Stage, no new issues were found. Marking bug as verified.