Front-end libraries should be bundled locally instead of loaded from CDNs

[PascalRepond]

How it works

Several front-end libraries are loaded at runtime from external CDNs instead of being bundled with the application:

Host	Resource	Integrity
cdn.jsdelivr.net	KaTeX 0.16.22 (CSS + 2 JS)	yes
cdn.jsdelivr.net	EasyMDE 2.16.1 (CSS + JS)	no
cdnjs.cloudflare.com	Popper 1.16.1, Font Awesome 4.7	yes
code.jquery.com	jQuery 3.5.1 slim	yes
stackpath.bootstrapcdn.com	Bootstrap 4.5.2	no
fonts.googleapis.com / fonts.gstatic.com	Roboto, Roboto Condensed	—

The concerned templates are sonar/theme/templates/sonar/page.html, sonar/modules/documents/templates/documents/record.html and sonar/theme/templates/sonar/page_wiki.html.

This has several consequences:

• Version inconsistency: the Bootstrap CSS is compiled from node_modules (bootstrap: ^4.3 in sonar/theme/webpack.py) while the Bootstrap JS is loaded from a CDN in 4.5.2.
• No integrity check on the Bootstrap and EasyMDE scripts, so nothing guarantees what is actually served.
• Availability: the pages depend on five third-party hosts at runtime, none of them under our control.
• Privacy: Google Fonts discloses the IP address of every visitor to Google, which is a concern for a platform hosted for Swiss public institutions.
• Dead weight: Font Awesome 4.7 is loaded on every page, while Font Awesome 7 is already bundled locally (sonar/theme/assets/scss/common/_fontawesome.scss) and the templates use the fa-solid syntax, which FA 4.7 does not provide.

Improvement suggestion

Bundle these libraries through webpack, as is already done for the Bootstrap CSS and Font Awesome:

• Add jquery, katex and easymde to the dependencies of the theme bundle in sonar/theme/webpack.py, along with the corresponding JS entries. bootstrap and popper.js are already declared there.
• Self-host the Roboto fonts, or drop them in favour of a system font stack.
• Remove the Font Awesome 4.7 stylesheet, and clean up the leftover fa class in sonar/theme/templates/sonar/macros/macro.html.

Side benefit: sonar/theme/static/js/app.js, the small fallback implementation of the dropdown and collapse plugins, currently has to stand down when a page happens to load the real Bootstrap plugins. With a single, controlled way of loading Bootstrap, that workaround could be removed.