Cherry-pick updates from upstream juniper.master branch

[mtyaka]

This cherry-picks security updates and fixes from open-release/juniper.master.

Sandbox:

• Ocim: https://manage.opencraft.com/instance/21770/
• LMS: https://juniper-security-fixes.opencraft.hosting
• Studio: https://studio.juniper-security-fixes.opencraft.hosting

Test instructions:

Verify that things work correctly with the security fixes & updates applied.
The main changes are in password reset handling and certificate URLs.

• Make sure that password reset still works
• Make sure that certificate work with the new URL. To test this I set up a certificate on the sandbox and verified that:
  • the new URL (without the user ID) works: https://studio.juniper-security-fixes.opencraft.hosting/certificates/course-v1:edX+DemoX+Demo_Course
  • the old URL shows a warning and instructions on how to obtain a new link: https://juniper-security-fixes.opencraft.hosting/certificates/user/6/course/course-v1:edX+DemoX+Demo_Course?preview=honor

Reviewers:

• @clemente ?

[clemente]

👍

• I tested this: (describe what you tested)
  • in the sandbox, the password reset form worked and I could change mine. It's not very intuitive in an edge case (when you mistype the new password you want, it will refresh and complain that the password reset link isn't valid, and you need to click the link again)
  • the password reset link went to https://juniper-security-fixes.opencraft.hosting/password_reset_confirm/c-5kp-505exxxxxxxxxxxxxxxxx/?track=pwreset, which redirected to https://juniper-security-fixes.opencraft.hosting/password_reset_confirm/c-set-password/, and this means that clicking away from this page wont't leak the token in the Referer HTTP field
  • the video transcript upload (previously broken): in Advanced → transcript languages → add → upload → I could upload one. This was fixed by a previous commit but is part of SE-3474 too
  • the signature upload worked (fixed in the same way)
  • [] some of the CMS parts affected by juniper-sustaining-security-fixes-6.patch are working. I didn't test this since the changes seem small and it would take long to test, and we rely on the upstream patch working
  • the new certificate URL works, and the old one shows a warning
• I read through the code
  • I checked that the sandbox runs the right branch
  • it applies juniper-sustaining-security-fixes-6.patch (CMS), in full
  • it doesn't apply the fix for the video upload because it was already merged in #272
  • it applies the fix for the password reset
  • it includes 3 other commits from upstream (juniper-worker, exposed user id in certificates, Django 2.2.16)
• I checked for accessibility issues: no new ones
• Includes documentation: not needed