Fixes:
- [core] Chart tooltips now show label text as text, so a label is never treated as markup, and the dashboard undoes the same key substitutions the api applies (
$,.,▯and their url encoded forms) instead of only two of them - [core] guard stored-document walks against prototype keys
- [license] Fixes for license manager forward compatibility
- [ab-testing] do not keep the request's credentials in stored experiments
Security Fixes:
- [drill] read the timeline exclude list whichever way it arrives
- [oidc]: mark the OIDC session token as login-capable