Update IDP and dependencies

[micbar]

Description

We are approaching a new major release and need to keep the IdP dependencies up to date and free of vulnerabilities.

[kulmann]

Asked the kpop devs if we can remove cldr (which brings in the outdated xmldom package`) from the dependencies upstream, see Kopano-dev/kpop#40

[micbar]

@kulmann Assigning you to avoid confusion in the ocis team.

[kulmann]

We made #7988 to mitigate the security concerns. @rhafer voiced his opinion here #7988 (comment) to stay in sync with upstream as much as possible. I'm not in favour of that "busy work" because there are plans to switch to Authelia and nobody here has in depth understanding of the lico ui. Needs a decision.

[micbar]

Fine for now.

[rhafer]

nobody here has in depth understanding of the lico ui

That alone already sound like a really good reason to stay as close to upstream as possible IMO. Keeping it diverging further makes maintenance even harder.

there are plans to switch to Authelia

We have been mumbling about that for a while now. But there has been very little progress, nor a full understanding what we actually need for that. And we'll have to live with lico for at least the whole 5.0.0 lifetime.