Update to upstream version '0.6.1'
with Debian dir 9740be29e86f6ed59eebe7582889577cb507edcd

When a user session has been terminated without using the logout view
(for instance a user can logout from all its authenticated sessions
using the Keycloak account UI), the expired OIDC profile is still
in webapp cache which causes errors and prevent new user logins.

So ensure to remove expired profile from cache when detecting Keycloak
session is no longer active in django authentication backend.

Related to T3496

Update to upstream version '0.6.0'
with Debian dir ff47451b163e85f97e410a489917bdb72e9564ff

Migrate auth command group from swh-web-client package to the
swh-auth package.

Related to T3385

Update to upstream version '0.5.4'
with Debian dir cbe48f053487b764e821b58c42f99771c4bf5fbc

Enable to check package documentation can be built without producing
sphinx warnings.

The sphinx environment is designed to be used in continuous integration
in order to prevent breaking documentation build when committing changes.

The sphinx-dev environment is designed to be used inside a full swh
development environment.

Related to T3258

Sphinx complains about an unexpected indentation if a constructor
docstring is missing.

Update to upstream version '0.5.3'
with Debian dir 8f38f1cf481f6704d46766c90fb3a171713618a9

Keycloak also allow to define user roles at realm level to define
permissions at a global level not tight to a client.

Include these extra roles in the user permissions set from the
decoded token content.

Related to T3213

Update to upstream version '0.5.2'
with Debian dir 69e67746b190093b5e4b8204de533b48b0806e20

The first time a user sends an expired token previously used to
perform authenticated Web API calls, Keycloak will return the
following error message: "Offline session not active".

So handle that error message too for indicating a token has expired.

Related to T3121

Update to upstream version '0.5.1'
with Debian dir f0529536b7e4e90479368a95b6c4b3dcbd115f26