refs #19298 - update fact test to find links in ol/li elements

Fixes #19217 - update the close icon to remove icon

In "Add Parameters" and "Add Combinations", we noticed
there are "Remove" icons, but currently using the Close
icon, based on the icon guideline, we suggest to use the
right icon for correct meaning.

fixes #19035 - rewrite TopbarSweeper without rails-observers

Moves from the observer object into two mixins, one on the model and one
on the top-level controllers to observe creates/updates/destroys on
monitored models. Replaces rails-observers as it lacks Rails 5 support.

Fixes #18001 - Add plugin permissions to core's roles

refs #18950 - wait for CR test connection to complete

fixes #18950 - enable password field in CR form test

Prior to capybara 2.13.0, the test passed despite filling in a disabled
password field, but a change now prevents this odd assumption. The test
now enables the field via the provided button, also requiring JS.

refs #18760 - only build CSV URL from permitted params

Prevents malicious data being injected into the URL options (e.g. host)
and prevents a security exception rendering URLs with non-sanitised
params under Rails 5.0.

Fixes #18718 - Empty boolean matcher should not turn into false

Fixes #18722 - fix host parameters in host form

Fixes #16982 - Scope properly when no taxonomies are set

The default scope for hosts and other objects did not restrict
properly by taxonomies. An user without organizations or
locations, could do anything it's permissions allow to.
The list of hosts was unrestricted and showed hosts in...